UI bugfixes with boss

flask_app/app/tests/routes.py

@@ -56,7 +56,13 @@ from ..services.test_attempt import (
     start_attempt,
     submit_attempt,
 )
-from ..services.test_access import is_test_author, list_hidden_by_author, list_visible_tests
+from ..services.test_access import (
+    is_test_author,
+    is_test_edit_open,
+    list_hidden_by_author,
+    list_visible_tests,
+    user_has_test_access,
+)
 from ..services.test_chain import has_any_attempt_for_test
 from ..services.test_draft import (
     HttpError as DraftHttpError,
@@ -97,7 +103,7 @@ def _check_test_author_or_404(test_id: str, user_id: str) -> Test:
     if not test:
         from werkzeug.exceptions import NotFound
         raise NotFound(RU['notFound'])
-    if not is_test_author(test.created_by, user_id):
+    if not is_test_author(test.created_by, user_id) and not is_test_edit_open():
         from werkzeug.exceptions import Forbidden
         raise Forbidden('Доступ запрещён.')
     return test
@@ -150,11 +156,11 @@ def api_test_summary(test_id):
         return jsonify(error=RU['notFound']), 404
 
     is_author = is_test_author(test.created_by, user.id)
-    if not test.is_active and not is_author:
+    open_edit = is_test_edit_open()
+    if not test.is_active and not is_author and not open_edit:
         return jsonify(error=RU['notFound']), 404
 
-    if not is_author:
-        from ..services.test_access import user_has_test_access
+    if not is_author and not open_edit:
         acc = user_has_test_access(user.id, test_id)
         if not acc.ok:
             return jsonify(error=RU['notFound']), 404
@@ -199,7 +205,7 @@ def api_test_versions(test_id):
     )
     if not test:
         return jsonify(error=RU['notFound']), 404
-    if not is_test_author(test.created_by, user.id):
+    if not is_test_author(test.created_by, user.id) and not is_test_edit_open():
         return jsonify(error='Доступ запрещён.'), 403
 
     has_attempts = has_any_attempt_for_test(session, tid)