Merge pull request #93 from silvioheinze/improve-anonymous-mapping

Add anonymous data input features and related settings

Author: silvioheinze

app/datasets/migrations/0034_add_anonymous_show_all_points.py

@@ -0,0 +1,21 @@
+# Generated manually for anonymous map visibility setting
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('datasets', '0033_map_default_zoom_range_1_20'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='dataset',
+            name='anonymous_show_all_points',
+            field=models.BooleanField(
+                default=False,
+                help_text='When anonymous data input is enabled: show all geometry points on the map to anonymous contributors (not only their own). Editing stays limited to own points.',
+            ),
+        ),
+    ]

app/datasets/migrations/0035_alter_anonymous_show_all_points_help_text.py

@@ -0,0 +1,22 @@
+# Generated by Django 6.0.4 on 2026-04-29 12:31
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('datasets', '0034_add_anonymous_show_all_points'),
+    ]
+
+    operations = [
+        migrations.AlterModelOptions(
+            name='mappingarea',
+            options={'ordering': ['name'], 'verbose_name_plural': 'Mapping Areas'},
+        ),
+        migrations.AlterField(
+            model_name='dataset',
+            name='anonymous_show_all_points',
+            field=models.BooleanField(default=False, help_text='When anonymous data input is enabled: show all geometry points on the map; anonymous contributors may load details and edit entries on any geometry in this dataset (not only their own). When disabled, they only see and edit their own points.'),
+        ),
+    ]

app/datasets/migrations/0036_add_anonymous_disable_new_points.py

@@ -0,0 +1,21 @@
+# Generated manually for anonymous "deactivate new points" setting
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('datasets', '0035_alter_anonymous_show_all_points_help_text'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='dataset',
+            name='anonymous_disable_new_points',
+            field=models.BooleanField(
+                default=False,
+                help_text='When anonymous data input is enabled: anonymous contributors cannot create new geometry points; they can only open existing points and add or edit entries.',
+            ),
+        ),
+    ]

app/datasets/migrations/0037_add_anonymous_show_all_mapping_areas.py

@@ -0,0 +1,21 @@
+# Anonymous show all mapping areas outlines on data-input map
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('datasets', '0036_add_anonymous_disable_new_points'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='dataset',
+            name='anonymous_show_all_mapping_areas',
+            field=models.BooleanField(
+                default=False,
+                help_text='When anonymous data input and mapping areas are enabled: show all mapping area outlines (with names) on the anonymous data-input map. Does not grant anonymous mapping-area editing.',
+            ),
+        ),
+    ]

app/datasets/models.py

@@ -30,6 +30,18 @@ class DataSet(models.Model):
     allow_multiple_entries = models.BooleanField(default=False, help_text="Allow multiple data entries per geometry point")
     enable_mapping_areas = models.BooleanField(default=False, help_text="Enable mapping areas functionality for this dataset")
     allow_anonymous_data_input = models.BooleanField(default=False, help_text="Allow data input without login via shareable URL")
+    anonymous_show_all_points = models.BooleanField(
+        default=False,
+        help_text="When anonymous data input is enabled: show all geometry points on the map; anonymous contributors may load details and edit entries on any geometry in this dataset (not only their own). When disabled, they only see and edit their own points.",
+    )
+    anonymous_disable_new_points = models.BooleanField(
+        default=False,
+        help_text="When anonymous data input is enabled: anonymous contributors cannot create new geometry points; they can only open existing points and add or edit entries.",
+    )
+    anonymous_show_all_mapping_areas = models.BooleanField(
+        default=False,
+        help_text="When anonymous data input and mapping areas are enabled: show all mapping area outlines (with names) on the anonymous data-input map. Does not grant anonymous mapping-area editing.",
+    )
     anonymous_access_token = models.CharField(max_length=64, unique=True, null=True, blank=True, help_text="Secret token for anonymous access URL")
     map_default_lat = models.DecimalField(max_digits=9, decimal_places=6, null=True, blank=True, help_text="Default map center latitude when opening data input")
     map_default_lng = models.DecimalField(max_digits=9, decimal_places=6, null=True, blank=True, help_text="Default map center longitude when opening data input")
@@ -137,6 +149,18 @@ def user_has_geometry_access(self, user, geometry_obj):
             geometry__covers=geometry_obj.geometry
         ).exists()
 
+    def anonymous_contributor_can_use_geometry(self, geometry_obj, virtual_contributor):
+        """
+        Whether an anonymous virtual contributor may load details, edit entries, upload files, etc.
+        for this geometry: always their own points; when anonymous_show_all_points is enabled,
+        any geometry in this dataset.
+        """
+        if virtual_contributor is None or geometry_obj.dataset_id != self.pk:
+            return False
+        if geometry_obj.virtual_contributor_id == virtual_contributor.id:
+            return True
+        return bool(getattr(self, 'anonymous_show_all_points', False))
+
     class Meta:
         ordering = ['-created_at']
 

app/datasets/tests/test_anonymous_show_all_points.py

@@ -0,0 +1,150 @@
+"""Anonymous 'show all points' map visibility."""
+import json
+import uuid
+
+from django.contrib.gis.geos import Point
+from django.contrib.auth.models import User
+from django.test import Client, TestCase
+from django.urls import reverse
+
+from datasets.models import DataEntry, DataGeometry, DataSet, VirtualContributor
+
+
+class AnonymousShowAllPointsTests(TestCase):
+    def setUp(self):
+        self.owner = User.objects.create_user(username='owner', password='pass')
+        self.dataset = DataSet.objects.create(
+            name='Anon Dataset',
+            owner=self.owner,
+            allow_anonymous_data_input=True,
+            anonymous_show_all_points=False,
+        )
+        self.dataset.ensure_anonymous_access_token()
+        self.dataset.refresh_from_db()
+
+        self.vc_self = VirtualContributor.objects.create(
+            dataset=self.dataset,
+            uuid=uuid.uuid4(),
+            display_name='Self',
+        )
+        self.vc_other = VirtualContributor.objects.create(
+            dataset=self.dataset,
+            uuid=uuid.uuid4(),
+            display_name='Other',
+        )
+
+        self.geom_self = DataGeometry.objects.create(
+            dataset=self.dataset,
+            id_kurz='A',
+            address='A',
+            geometry=Point(16.37, 48.21, srid=4326),
+            virtual_contributor=self.vc_self,
+        )
+        self.geom_other = DataGeometry.objects.create(
+            dataset=self.dataset,
+            id_kurz='B',
+            address='B',
+            geometry=Point(16.38, 48.22, srid=4326),
+            virtual_contributor=self.vc_other,
+        )
+        self.entry_other = DataEntry.objects.create(
+            geometry=self.geom_other,
+            name='Other entry',
+            year=2020,
+            virtual_contributor=self.vc_other,
+        )
+
+        self.anon_client = Client()
+        sid = self.dataset.id
+        session = self.anon_client.session
+        session[f'anonymous_token_{sid}'] = self.dataset.anonymous_access_token
+        session[f'virtual_contributor_uuid_{sid}'] = str(self.vc_self.uuid)
+        session.save()
+
+    def _map_ids(self):
+        url = reverse('dataset_map_data', kwargs={'dataset_id': self.dataset.id})
+        r = self.anon_client.get(url)
+        self.assertEqual(r.status_code, 200)
+        return {row['id'] for row in r.json().get('map_data', [])}
+
+    def test_map_data_only_own_points_when_flag_off(self):
+        self.assertEqual(self._map_ids(), {self.geom_self.id})
+
+    def test_map_data_all_points_when_flag_on(self):
+        self.dataset.anonymous_show_all_points = True
+        self.dataset.save(update_fields=['anonymous_show_all_points'])
+        self.assertSetEqual(self._map_ids(), {self.geom_self.id, self.geom_other.id})
+
+    def test_geometry_details_other_denied_when_flag_off(self):
+        url = reverse('geometry_details', kwargs={'geometry_id': self.geom_other.id})
+        r = self.anon_client.get(url)
+        self.assertEqual(r.status_code, 403)
+
+    def test_geometry_details_other_allowed_when_flag_on(self):
+        self.dataset.anonymous_show_all_points = True
+        self.dataset.save(update_fields=['anonymous_show_all_points'])
+        url = reverse('geometry_details', kwargs={'geometry_id': self.geom_other.id})
+        r = self.anon_client.get(url)
+        self.assertEqual(r.status_code, 200)
+        self.assertTrue(r.json().get('success'))
+
+    def test_save_entries_other_geometry_denied_when_flag_off(self):
+        url = reverse('save_entries')
+        r = self.anon_client.post(
+            url,
+            {
+                'geometry_id': str(self.geom_other.id),
+                'entries[0][id]': str(self.entry_other.id),
+            },
+        )
+        self.assertEqual(r.status_code, 403)
+
+    def test_save_entries_other_geometry_allowed_when_flag_on(self):
+        self.dataset.anonymous_show_all_points = True
+        self.dataset.save(update_fields=['anonymous_show_all_points'])
+        url = reverse('save_entries')
+        r = self.anon_client.post(
+            url,
+            {
+                'geometry_id': str(self.geom_other.id),
+                'entries[0][id]': str(self.entry_other.id),
+            },
+        )
+        self.assertEqual(r.status_code, 200)
+        self.assertTrue(r.json().get('success'))
+
+    def test_geometry_create_denied_when_anonymous_disable_new_points(self):
+        self.dataset.anonymous_disable_new_points = True
+        self.dataset.save(update_fields=['anonymous_disable_new_points'])
+        url = reverse('geometry_create', kwargs={'dataset_id': self.dataset.id})
+        payload = {
+            'id_kurz': 'NEW_PT',
+            'address': 'New',
+            'geometry': {'type': 'Point', 'coordinates': [16.4, 48.25]},
+        }
+        r = self.anon_client.post(
+            url,
+            data=json.dumps(payload),
+            content_type='application/json',
+            HTTP_X_REQUESTED_WITH='XMLHttpRequest',
+        )
+        self.assertEqual(r.status_code, 403)
+        body = r.json()
+        self.assertFalse(body.get('success', True))
+        self.assertIn('disabled', (body.get('error') or '').lower())
+
+    def test_geometry_create_allowed_when_anonymous_disable_new_points_off(self):
+        url = reverse('geometry_create', kwargs={'dataset_id': self.dataset.id})
+        payload = {
+            'id_kurz': 'NEW_PT2',
+            'address': 'New',
+            'geometry': {'type': 'Point', 'coordinates': [16.41, 48.26]},
+        }
+        r = self.anon_client.post(
+            url,
+            data=json.dumps(payload),
+            content_type='application/json',
+            HTTP_X_REQUESTED_WITH='XMLHttpRequest',
+        )
+        self.assertEqual(r.status_code, 200)
+        self.assertTrue(r.json().get('success'))

app/datasets/tests/test_mapping_area_anonymous_outlines.py

@@ -0,0 +1,74 @@
+"""Anonymous mapping area outlines API (read-only, session token)."""
+
+from django.contrib.auth.models import User
+from django.contrib.gis.geos import MultiPolygon, Polygon
+from django.test import Client, TestCase
+from django.urls import reverse
+
+from datasets.models import DataSet, MappingArea
+
+
+class MappingAreaAnonymousOutlinesTests(TestCase):
+    def setUp(self):
+        self.owner = User.objects.create_user(username='owner', password='pass')
+        self.dataset = DataSet.objects.create(
+            name='Anon MA',
+            owner=self.owner,
+            allow_anonymous_data_input=True,
+            enable_mapping_areas=True,
+            anonymous_show_all_mapping_areas=False,
+        )
+        self.dataset.ensure_anonymous_access_token()
+        self.dataset.refresh_from_db()
+
+        polygon = Polygon(
+            (
+                (-0.1, -0.1),
+                (-0.1, 0.1),
+                (0.1, 0.1),
+                (0.1, -0.1),
+                (-0.1, -0.1),
+            ),
+            srid=4326,
+        )
+        self.area = MappingArea.objects.create(
+            dataset=self.dataset,
+            name='North',
+            geometry=MultiPolygon(polygon, srid=4326),
+            created_by=self.owner,
+        )
+
+        self.url = reverse('mapping_area_anonymous_outlines', args=[self.dataset.id])
+        self.client = Client()
+
+    def _set_session_token(self, token):
+        session = self.client.session
+        session[f'anonymous_token_{self.dataset.id}'] = token
+        session.save()
+
+    def test_invalid_token_returns_403(self):
+        self._set_session_token('wrong-token')
+        r = self.client.get(self.url)
+        self.assertEqual(r.status_code, 403)
+        self.assertFalse(r.json().get('success', True))
+
+    def test_flag_off_returns_empty_list(self):
+        self._set_session_token(self.dataset.anonymous_access_token)
+        r = self.client.get(self.url)
+        self.assertEqual(r.status_code, 200)
+        data = r.json()
+        self.assertTrue(data['success'])
+        self.assertEqual(data['mapping_areas'], [])
+
+    def test_flag_on_returns_all_areas(self):
+        self.dataset.anonymous_show_all_mapping_areas = True
+        self.dataset.save(update_fields=['anonymous_show_all_mapping_areas'])
+        self._set_session_token(self.dataset.anonymous_access_token)
+        r = self.client.get(self.url)
+        self.assertEqual(r.status_code, 200)
+        data = r.json()
+        self.assertTrue(data['success'])
+        self.assertEqual(len(data['mapping_areas']), MappingArea.objects.filter(dataset=self.dataset).count())
+        first = next(a for a in data['mapping_areas'] if a['id'] == self.area.id)
+        self.assertEqual(first['name'], 'North')
+        self.assertEqual(first['geometry']['type'], 'MultiPolygon')