From 8a0430534a60f51545ed110f4c5cd973e2a7fd47 Mon Sep 17 00:00:00 2001
From: Fredrik Jonsson <frjo@xdeb.org>
Date: Fri, 1 May 2026 20:55:03 +0200
Subject: [PATCH 1/4] Proper confirm dialogs for batch archive and batch delete
 of submissions.

---
 .../funds/templates/submissions/all.html      | 10 ++--
 .../submissions/bulk_archive_confirm.html     | 39 ++++++++++++++++
 .../submissions/bulk_delete_confirm.html      | 16 +++++++
 hypha/apply/funds/urls.py                     | 12 +++++
 hypha/apply/funds/views/all.py                | 46 +++++++++++++++----
 hypha/templates/cotton/modal/confirm.html     |  2 +-
 6 files changed, 111 insertions(+), 14 deletions(-)
 create mode 100644 hypha/apply/funds/templates/submissions/bulk_archive_confirm.html
 create mode 100644 hypha/apply/funds/templates/submissions/bulk_delete_confirm.html

diff --git a/hypha/apply/funds/templates/submissions/all.html b/hypha/apply/funds/templates/submissions/all.html
index 5f0e5a57bc..6566f469cb 100644
--- a/hypha/apply/funds/templates/submissions/all.html
+++ b/hypha/apply/funds/templates/submissions/all.html
@@ -480,9 +480,10 @@
 
                 {% if can_bulk_archive %}
                     <button
-                        hx-post="{% url 'apply:submissions:bulk-archive' %}"
+                        hx-get="{% url 'apply:submissions:bulk-archive-confirm' %}"
                         hx-include="[name='selectedSubmissionIds']"
-                        hx-confirm="{% trans 'Are you sure you want to archive the selected submissions?' %}"
+                        hx-target="#htmx-modal"
+                        hx-swap="innerHTML"
                         class="btn btn-sm"
                     >
                         {% heroicon_outline "lock-closed" aria_hidden="true" size=14 class="stroke-base-content/80" %}
@@ -492,9 +493,10 @@
 
                 {% if can_bulk_delete %}
                     <button
-                        hx-post="{% url 'apply:submissions:bulk-delete' %}"
+                        hx-get="{% url 'apply:submissions:bulk-delete-confirm' %}"
                         hx-include="[name='selectedSubmissionIds']"
-                        hx-confirm="{% trans 'Are you sure you want to delete the selected submissions? This action cannot be undone.' %}"
+                        hx-target="#htmx-modal"
+                        hx-swap="innerHTML"
                         class="btn btn-sm"
                     >
                         {% heroicon_outline "trash" aria_hidden="true" size=14 class="stroke-base-content/80" %}
diff --git a/hypha/apply/funds/templates/submissions/bulk_archive_confirm.html b/hypha/apply/funds/templates/submissions/bulk_archive_confirm.html
new file mode 100644
index 0000000000..ba3c179693
--- /dev/null
+++ b/hypha/apply/funds/templates/submissions/bulk_archive_confirm.html
@@ -0,0 +1,39 @@
+{% load i18n heroicons %}
+
+<form class="px-4 pt-5 pb-4 sm:p-6 form" action="{% url 'apply:submissions:bulk-archive' %}" method="post">
+    {% csrf_token %}
+
+    <div class="sm:flex sm:items-start">
+        <div class="flex justify-center items-center mx-auto w-12 h-12 rounded-full sm:mx-0 sm:w-10 sm:h-10 bg-warning/10 shrink-0">
+            {% heroicon_outline "exclamation-triangle" class="w-6 h-6 text-warning" stroke_width="1.5" aria_hidden="true" %}
+        </div>
+        <div class="mt-3 text-center sm:mt-0 sm:ml-4 sm:text-left">
+            <h3 class="text-base font-semibold leading-6 text-base-content" id="modal-title">{% trans "Archive submissions" %}</h3>
+            <div class="mt-2">
+                <p class="text-sm text-fg-muted">
+                    {% blocktranslate trimmed with count=submission_ids|length %}
+                        Are you sure you want to archive {{ count }} submission(s)?
+                        Archived submissions will be hidden from the main list and cannot be edited.
+                        Submissions can be unarchived at any time.
+                    {% endblocktranslate %}
+                </p>
+            </div>
+        </div>
+    </div>
+
+    {% for id in submission_ids %}
+        <input type="hidden" name="selectedSubmissionIds" value="{{ id }}">
+    {% endfor %}
+
+    <div class="mt-5 sm:flex-row-reverse sm:mt-4 card-actions">
+        <button
+            type="submit"
+            class="w-full sm:w-auto btn btn-warning"
+        >{% trans "Archive" %}</button>
+        <button
+            type="button"
+            class="w-full sm:w-auto btn btn-secondary btn-outline btn-soft"
+            @click="show = false"
+        >{% trans "Cancel" %}</button>
+    </div>
+</form>
diff --git a/hypha/apply/funds/templates/submissions/bulk_delete_confirm.html b/hypha/apply/funds/templates/submissions/bulk_delete_confirm.html
new file mode 100644
index 0000000000..41bf35700e
--- /dev/null
+++ b/hypha/apply/funds/templates/submissions/bulk_delete_confirm.html
@@ -0,0 +1,16 @@
+{% load i18n %}
+
+<c-modal.confirm
+    title="{% trans 'Delete applications' %}"
+    action="{% url 'apply:submissions:bulk-delete' %}"
+>
+    <p class="text-sm text-fg-muted">
+        {% blocktranslate trimmed with count=submission_ids|length %}
+            Are you sure you want to permanently delete {{ count }} submission(s)?
+            All data will be permanently removed. This action cannot be undone.
+        {% endblocktranslate %}
+    </p>
+    {% for id in submission_ids %}
+        <input type="hidden" name="selectedSubmissionIds" value="{{ id }}">
+    {% endfor %}
+</c-modal.confirm>
diff --git a/hypha/apply/funds/urls.py b/hypha/apply/funds/urls.py
index 300cdcb87a..5fae67faa6 100644
--- a/hypha/apply/funds/urls.py
+++ b/hypha/apply/funds/urls.py
@@ -12,7 +12,9 @@
 from .views.all import (
     bulk_anonymize_submissions,
     bulk_archive_submissions,
+    bulk_archive_submissions_confirm,
     bulk_delete_submissions,
+    bulk_delete_submissions_confirm,
     bulk_update_submissions_status,
     submissions_all,
 )
@@ -97,7 +99,17 @@
         ),
         path("success/<int:pk>/", submission_success, name="success"),
         path("all/", submissions_all, name="list"),
+        path(
+            "all/bulk_archive_confirm/",
+            bulk_archive_submissions_confirm,
+            name="bulk-archive-confirm",
+        ),
         path("all/bulk_archive/", bulk_archive_submissions, name="bulk-archive"),
+        path(
+            "all/bulk_delete_confirm/",
+            bulk_delete_submissions_confirm,
+            name="bulk-delete-confirm",
+        ),
         path("all/bulk_delete/", bulk_delete_submissions, name="bulk-delete"),
         path("all/bulk_anonymize/", bulk_anonymize_submissions, name="bulk-anonymize"),
         path(
diff --git a/hypha/apply/funds/views/all.py b/hypha/apply/funds/views/all.py
index 90e4c37037..49f6981bf4 100644
--- a/hypha/apply/funds/views/all.py
+++ b/hypha/apply/funds/views/all.py
@@ -9,13 +9,9 @@
 from django.core.exceptions import PermissionDenied
 from django.core.paginator import Paginator
 from django.db import models
-from django.http import (
-    HttpRequest,
-    HttpResponse,
-    HttpResponseForbidden,
-)
-from django.shortcuts import render
-from django.urls import reverse_lazy
+from django.http import HttpRequest, HttpResponse, HttpResponseForbidden
+from django.shortcuts import redirect, render
+from django.urls import reverse, reverse_lazy
 from django.utils.translation import gettext as _
 from django.views.decorators.http import require_http_methods
 from django_htmx.http import HttpResponseClientRedirect, HttpResponseClientRefresh
@@ -348,6 +344,20 @@ def submissions_all(
     return render(request, template_name, ctx)
 
 
+@login_required
+@require_http_methods(["GET"])
+def bulk_archive_submissions_confirm(request):
+    if not permissions.can_bulk_archive_submissions(request.user):
+        return HttpResponseForbidden()
+
+    submission_ids = request.GET.getlist("selectedSubmissionIds")
+    return render(
+        request,
+        "submissions/bulk_archive_confirm.html",
+        {"submission_ids": submission_ids},
+    )
+
+
 @login_required
 @require_http_methods(["POST"])
 def bulk_archive_submissions(request):
@@ -363,7 +373,23 @@ def bulk_archive_submissions(request):
         request=request,
     )
 
-    return HttpResponseClientRefresh()
+    if request.htmx:
+        return HttpResponseClientRefresh()
+    return redirect(reverse("apply:submissions:list"))
+
+
+@login_required
+@require_http_methods(["GET"])
+def bulk_delete_submissions_confirm(request):
+    if not permissions.can_bulk_delete_submissions(request.user):
+        return HttpResponseForbidden()
+
+    submission_ids = request.GET.getlist("selectedSubmissionIds")
+    return render(
+        request,
+        "submissions/bulk_delete_confirm.html",
+        {"submission_ids": submission_ids},
+    )
 
 
 @login_required
@@ -381,7 +407,9 @@ def bulk_delete_submissions(request):
         request=request,
     )
 
-    return HttpResponseClientRefresh()
+    if request.htmx:
+        return HttpResponseClientRefresh()
+    return redirect(reverse("apply:submissions:list"))
 
 
 @login_required
diff --git a/hypha/templates/cotton/modal/confirm.html b/hypha/templates/cotton/modal/confirm.html
index e7c5a3f181..d43de7ad22 100644
--- a/hypha/templates/cotton/modal/confirm.html
+++ b/hypha/templates/cotton/modal/confirm.html
@@ -2,7 +2,7 @@
 
 <form
     class="px-4 pt-5 pb-4 sm:p-6"
-    action="{{ request.path }}"
+    action="{% if action %}{{ action }}{% else %}{{ request.path }}{% endif %}"
     method="post"
     x-data="{userConfirmationInput: '', delConfirmText: `{% trans 'delete' %}`, anonConfirmText: `{% trans 'anonymize' %}`, mode: '{{ initial_mode|default:'delete' }}'}"
 >

From f2727ef77a4163195f2327a4b99c4a7ad46eba23 Mon Sep 17 00:00:00 2001
From: Fredrik Jonsson <frjo@xdeb.org>
Date: Fri, 1 May 2026 21:02:05 +0200
Subject: [PATCH 2/4] Proper confirm dialogs for batch anonymise of
 submissions.

---
 .../funds/templates/submissions/all.html      |  5 ++-
 .../submissions/bulk_anonymize_confirm.html   | 19 +++++++++
 hypha/apply/funds/urls.py                     |  6 +++
 hypha/apply/funds/views/all.py                | 41 +++++++++++++------
 4 files changed, 57 insertions(+), 14 deletions(-)
 create mode 100644 hypha/apply/funds/templates/submissions/bulk_anonymize_confirm.html

diff --git a/hypha/apply/funds/templates/submissions/all.html b/hypha/apply/funds/templates/submissions/all.html
index 6566f469cb..d84de2f083 100644
--- a/hypha/apply/funds/templates/submissions/all.html
+++ b/hypha/apply/funds/templates/submissions/all.html
@@ -504,9 +504,10 @@
                     </button>
                     {% if SUBMISSION_ANONYMIZATION_ENABLED %}
                         <button
-                            hx-post="{% url 'apply:submissions:bulk-anonymize' %}"
+                            hx-get="{% url 'apply:submissions:bulk-anonymize-confirm' %}"
                             hx-include="[name='selectedSubmissionIds']"
-                            hx-confirm="{% trans 'Are you sure you want to anonymize the selected submissions? All draft submission will be deleted. This action cannot be undone.' %}"
+                            hx-target="#htmx-modal"
+                            hx-swap="innerHTML"
                             class="btn btn-sm"
                         >
                             {% heroicon_outline "user-minus" aria_hidden="true" size=14 class="stroke-base-content/80" %}
diff --git a/hypha/apply/funds/templates/submissions/bulk_anonymize_confirm.html b/hypha/apply/funds/templates/submissions/bulk_anonymize_confirm.html
new file mode 100644
index 0000000000..8e0f822246
--- /dev/null
+++ b/hypha/apply/funds/templates/submissions/bulk_anonymize_confirm.html
@@ -0,0 +1,19 @@
+{% load i18n %}
+
+<c-modal.confirm
+    title="{% trans 'Anonymize applications' %}"
+    action="{% url 'apply:submissions:bulk-anonymize' %}"
+    initial_mode="anonymize"
+>
+    <p class="text-sm text-fg-muted">
+        {% blocktranslate trimmed with count=submission_ids|length %}
+            Are you sure you want to anonymize {{ count }} submission(s)?
+            Personal data will be removed and applications will only be accessible
+            via statistics in the Results view. All draft submissions will be deleted.
+            This action cannot be undone.
+        {% endblocktranslate %}
+    </p>
+    {% for id in submission_ids %}
+        <input type="hidden" name="selectedSubmissionIds" value="{{ id }}">
+    {% endfor %}
+</c-modal.confirm>
diff --git a/hypha/apply/funds/urls.py b/hypha/apply/funds/urls.py
index 5fae67faa6..f9a31d4835 100644
--- a/hypha/apply/funds/urls.py
+++ b/hypha/apply/funds/urls.py
@@ -11,6 +11,7 @@
 )
 from .views.all import (
     bulk_anonymize_submissions,
+    bulk_anonymize_submissions_confirm,
     bulk_archive_submissions,
     bulk_archive_submissions_confirm,
     bulk_delete_submissions,
@@ -111,6 +112,11 @@
             name="bulk-delete-confirm",
         ),
         path("all/bulk_delete/", bulk_delete_submissions, name="bulk-delete"),
+        path(
+            "all/bulk_anonymize_confirm/",
+            bulk_anonymize_submissions_confirm,
+            name="bulk-anonymize-confirm",
+        ),
         path("all/bulk_anonymize/", bulk_anonymize_submissions, name="bulk-anonymize"),
         path(
             "all/bulk_update_status/",
diff --git a/hypha/apply/funds/views/all.py b/hypha/apply/funds/views/all.py
index 49f6981bf4..0971f7d632 100644
--- a/hypha/apply/funds/views/all.py
+++ b/hypha/apply/funds/views/all.py
@@ -412,25 +412,42 @@ def bulk_delete_submissions(request):
     return redirect(reverse("apply:submissions:list"))
 
 
+@login_required
+@require_http_methods(["GET"])
+def bulk_anonymize_submissions_confirm(request):
+    if not settings.SUBMISSION_ANONYMIZATION_ENABLED:
+        return HttpResponseForbidden()
+    if not permissions.can_bulk_delete_submissions(request.user):
+        return HttpResponseForbidden()
+
+    submission_ids = request.GET.getlist("selectedSubmissionIds")
+    return render(
+        request,
+        "submissions/bulk_anonymize_confirm.html",
+        {"submission_ids": submission_ids},
+    )
+
+
 @login_required
 @require_http_methods(["POST"])
 def bulk_anonymize_submissions(request):
-    if settings.SUBMISSION_ANONYMIZATION_ENABLED:
-        if not permissions.can_bulk_delete_submissions(request.user):
-            return HttpResponseForbidden()
+    if not settings.SUBMISSION_ANONYMIZATION_ENABLED:
+        return HttpResponseForbidden()
+    if not permissions.can_bulk_delete_submissions(request.user):
+        return HttpResponseForbidden()
 
-        submission_ids = request.POST.getlist("selectedSubmissionIds")
-        submissions = ApplicationSubmission.objects.filter(id__in=submission_ids)
+    submission_ids = request.POST.getlist("selectedSubmissionIds")
+    submissions = ApplicationSubmission.objects.filter(id__in=submission_ids)
 
-        services.bulk_anonymize_submissions(
-            submissions=submissions,
-            user=request.user,
-            request=request,
-        )
+    services.bulk_anonymize_submissions(
+        submissions=submissions,
+        user=request.user,
+        request=request,
+    )
 
+    if request.htmx:
         return HttpResponseClientRefresh()
-
-    return HttpResponseForbidden()
+    return redirect(reverse("apply:submissions:list"))
 
 
 @login_required

From 9c28a1fac47b1872b0a01a32422db4ec71784bff Mon Sep 17 00:00:00 2001
From: Fredrik Jonsson <frjo@xdeb.org>
Date: Fri, 1 May 2026 21:17:42 +0200
Subject: [PATCH 3/4] Bug fix for count in confirm dialogs.

---
 hypha/templates/includes/_modal-placeholder.html | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/hypha/templates/includes/_modal-placeholder.html b/hypha/templates/includes/_modal-placeholder.html
index 6ed1ce90fd..759f8e1f65 100644
--- a/hypha/templates/includes/_modal-placeholder.html
+++ b/hypha/templates/includes/_modal-placeholder.html
@@ -9,6 +9,7 @@
 <div
     x-cloak
     x-data="{ show: false }"
+    x-init="$watch('show', v => { if (!v) $nextTick(() => { $refs.modalContent.innerHTML = '' }) })"
     @keydown.window.escape="show = false"
     x-show="show"
     class="relative z-10"
@@ -45,6 +46,7 @@
                 x-description="Modal panel, show/hide based on modal state."
                 class="relative w-full text-left rounded-lg border shadow-xl transition-all transform sm:my-8 sm:max-w-lg bg-base-100"
                 id="htmx-modal"
+                x-ref="modalContent"
                 hx-target="this"
                 @htmx:after-swap="show = true"
                 @htmx:before-swap="if(!$event.detail.xhr.response) { show = false; $event.detail.shouldSwap = false;}"

From 0fededeb7672be6d5d67de7fa0a9c705fade7a72 Mon Sep 17 00:00:00 2001
From: Fredrik Jonsson <frjo@xdeb.org>
Date: Fri, 1 May 2026 21:25:01 +0200
Subject: [PATCH 4/4] Replace one use of reverse_lazy with reverse.

---
 hypha/apply/funds/views/all.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hypha/apply/funds/views/all.py b/hypha/apply/funds/views/all.py
index 0971f7d632..b899d1c036 100644
--- a/hypha/apply/funds/views/all.py
+++ b/hypha/apply/funds/views/all.py
@@ -11,7 +11,7 @@
 from django.db import models
 from django.http import HttpRequest, HttpResponse, HttpResponseForbidden
 from django.shortcuts import redirect, render
-from django.urls import reverse, reverse_lazy
+from django.urls import reverse
 from django.utils.translation import gettext as _
 from django.views.decorators.http import require_http_methods
 from django_htmx.http import HttpResponseClientRedirect, HttpResponseClientRefresh
@@ -491,7 +491,7 @@ def bulk_update_submissions_status(request: HttpRequest) -> HttpResponse:
             return HttpResponseClientRefresh()
         action = outcome_from_actions(transitions)
         return HttpResponseClientRedirect(
-            reverse_lazy("apply:submissions:determinations:batch")
+            reverse("apply:submissions:determinations:batch")
             + "?action="
             + action
             + "&submissions="