use proper POST

itou/templates/geiq/list_base.html

@@ -11,9 +11,9 @@
     <h1>Mes salariés - {{ request.current_organization.display_name }} - {{ assessment.campaign.year }}</h1>
     <p>Dernière mise à jour: {{ assessment.last_synced_at|default:"-" }}</p>
     {% if not assessment.submitted_at and request.user.is_employer %}
-        <form hx-post="{% url "geiq:label_sync" assessment_pk=assessment.pk %}" hx-swap="none">
+        <form method="POST">
             {% csrf_token %}
-            <button class="btn" name="from_list">Mise à jour</button>
+            <button class="btn">Mise à jour</button>
         </form>
     {% endif %}
 {% endblock %}

itou/www/geiq_views/views.py

@@ -1,8 +1,9 @@
+import datetime
 import enum
 
 from django.contrib.auth.decorators import login_required, user_passes_test
 from django.db.models import Count, F, OuterRef, Prefetch, Q, Subquery, Sum
-from django.http import Http404, HttpResponse, HttpResponseRedirect
+from django.http import Http404, HttpResponseRedirect
 from django.shortcuts import get_object_or_404, render
 from django.urls import reverse
 from django.utils import timezone
@@ -115,7 +116,6 @@ def assessment_review(request, assessment_pk, template_name="geiq/assessment_rev
 
 
 @login_required
-@require_GET
 @user_passes_test(lambda user: user.is_active and (user.is_employer or user.is_labor_inspector))
 def employee_list(request, assessment_pk, info_type):
     try:
@@ -129,6 +129,8 @@ def employee_list(request, assessment_pk, info_type):
             company_id__in={org.pk for org in request.organizations}
         ).select_related("campaign", "company")
         assessment = get_object_or_404(assessments, pk=assessment_pk)
+    if request.POST and not assessment.submitted_at:
+        _lock_assessment_and_sync(assessment)
 
     match info_type:
         case InfoType.PERSONAL_INFORMATION:
@@ -185,6 +187,16 @@ def employee_list(request, assessment_pk, info_type):
     return render(request, template_name, context)
 
 
+def _lock_assessment_and_sync(assessment):
+    # Take lock
+    lock_assessment = get_object_or_404(ImplementationAssessment.objects.filter(pk=assessment.pk).select_for_update())
+    if lock_assessment.last_synced_at > timezone.now() + datetime.timedelta(minutes=1):
+        return False
+    # Use the provided assessment as it will update last_synced_at field
+    sync_employee_and_contracts(assessment)
+    return True
+
+
 @login_required
 @require_POST
 @user_passes_test(lambda user: user.is_active and user.is_employer)
@@ -193,16 +205,11 @@ def label_sync(request, assessment_pk):
         ImplementationAssessment.objects.filter(
             company_id__in={org.pk for org in request.organizations},
             submitted_at__isnull=True,  # You cannot sync data anymore after submission
-        ).select_for_update(of=["self"]),
+        ),
         pk=assessment_pk,
     )
+    _lock_assessment_and_sync(assessment)
 
-    # This will update last_synced_at field
-    sync_employee_and_contracts(assessment)
-    if "from_list" in request.POST:
-        # It might be cleaner to not use htmx in this case and a proper POST
-        # on the list URL (with sync=1 params) ? to directly return the reloaded page
-        return HttpResponse(headers={"HX-Refresh": "true"})
     context = {
         "assessment": assessment,
         "oob_swap": True,