Make results viewable by users if allowed by creator

Author: cirosilvano

src/experimental/doodle/browser/doodle_answer.pt

@@ -25,7 +25,7 @@
               </p>
             </div>
             <div class="doodle-header-actions"
-                 tal:condition="view/is_creator"
+                 tal:condition="view/can_view_results"
             >
               <a class="btn btn-secondary btn-sm"
                  tal:attributes="

src/experimental/doodle/browser/views.py

@@ -7,6 +7,7 @@
 from experimental.doodle.utils import format_date
 from experimental.doodle.utils import format_date_long
 from experimental.doodle.utils import get_member_info
+from experimental.doodle.utils import is_doodle_manager
 from experimental.doodle.utils import parse_iso_dates
 from experimental.doodle.utils import require_authenticated
 from Products.Five import BrowserView
@@ -32,7 +33,8 @@ def update(self):
         self.selected = (
             set(self.existing.get("selected_dates", [])) if self.existing else set()
         )
-        self.is_creator = can_view_results(self.context)
+        self.is_creator = is_doodle_manager(self.context)
+        self.can_view_results = can_view_results(self.context)
         self.results_url = f"{self.context.absolute_url()}/@@results"
 
         if self.request.method != "POST":
@@ -73,7 +75,7 @@ def format_date_long(self, value):
 
 
 class ResultsView(BrowserView):
-    """Creator-only summary of all answers."""
+    """Summary of all answers for users allowed to view results."""
 
     index = ViewPageTemplateFile("doodle_results.pt")
 

src/experimental/doodle/content/interfaces.py

@@ -19,3 +19,13 @@ class IDoodle(model.Schema):
         required=True,
         min_length=1,
     )
+
+    allow_members_view_results = schema.Bool(
+        title=_("Allow participants to view results"),
+        description=_(
+            "When enabled, any logged-in member who can view this doodle "
+            "may also open the results page."
+        ),
+        required=False,
+        default=False,
+    )

src/experimental/doodle/utils.py

@@ -29,6 +29,23 @@ def can_view_results(context):
     if member.has_role("Manager"):
         return True
     creator = getattr(context, "Creator", lambda: None)()
+    if creator == member.getId():
+        return True
+    if getattr(context, "allow_members_view_results", False):
+        return True
+    return False
+
+
+def is_doodle_manager(context):
+    """True if the current user may manage doodle settings (creator UI)."""
+    if api.user.is_anonymous():
+        return False
+    member = api.user.get_current()
+    if member is None:
+        return False
+    if member.has_role("Manager"):
+        return True
+    creator = getattr(context, "Creator", lambda: None)()
     return creator == member.getId()
 
 

tests/test_doodle.py

@@ -115,3 +115,27 @@ def test_non_creator_cannot_view_results(self, portal, http_request):
         view = ResultsView(obj, request)
         with pytest.raises(Unauthorized):
             view.update()
+
+    def test_member_can_view_results_when_allowed(self, portal, http_request):
+        obj = _create_doodle(portal)
+        obj.allow_members_view_results = True
+        upsert_answer(obj, "member", "Member", [date(2026, 5, 20)])
+        login(portal, TEST_USER_NAME)
+        request = _prepare_request(http_request)
+
+        html = ResultsView(obj, request)()
+
+        assert "Who can make it" in html
+        assert "Member" in html
+
+    def test_member_sees_results_link_when_allowed(self, portal, http_request):
+        obj = _create_doodle(portal)
+        obj.allow_members_view_results = True
+        login(portal, TEST_USER_NAME)
+        request = _prepare_request(http_request)
+        request.method = "GET"
+
+        html = AnswerView(obj, request)()
+
+        assert "View results" in html
+        assert "Share this link" not in html