Fix inherited permissions should not display per user in permissions form

diff --git a/src-ui/cypress/fixtures/documents/documents.json b/src-ui/cypress/fixtures/documents/documents.json
index be7640c8f3538e4b27fa44a345006b5d21fbc8a5..e3938dba19b82081796749f7353b11ece49c8741 100644 (file)
--- a/src-ui/cypress/fixtures/documents/documents.json
+++ b/src-ui/cypress/fixtures/documents/documents.json
@@ -21,7 +21,16 @@
             "original_file_name": "2022-03-22 no latin title.pdf",
             "archived_file_name": "2022-03-22 no latin title.pdf",
             "owner": null,
-            "permissions": [],
+            "permissions": {
+                "view": {
+                    "users": [],
+                    "groups": []
+                },
+                "change": {
+                    "users": [],
+                    "groups": []
+                }
+            },
             "notes": [
                 {
                     "id": 9,
@@ -59,7 +68,16 @@
             "original_file_name": "2022-03-23 lorem ipsum dolor sit amet.pdf",
             "archived_file_name": "2022-03-23 llorem ipsum dolor sit amet.pdf",
             "owner": null,
-            "permissions": [],
+            "permissions": {
+                "view": {
+                    "users": [],
+                    "groups": []
+                },
+                "change": {
+                    "users": [],
+                    "groups": []
+                }
+            },
             "notes": []
         },
         {
@@ -80,7 +98,16 @@
             "original_file_name": "2022-03-24 dolor.pdf",
             "archived_file_name": "2022-03-24 dolor.pdf",
             "owner": null,
-            "permissions": [],
+            "permissions": {
+                "view": {
+                    "users": [],
+                    "groups": []
+                },
+                "change": {
+                    "users": [],
+                    "groups": []
+                }
+            },
             "notes": []
         },
         {
@@ -101,7 +128,16 @@
             "original_file_name": "2022-06-01 sit amet.pdf",
             "archived_file_name": "2022-06-01 sit amet.pdf",
             "owner": null,
-            "permissions": [],
+            "permissions": {
+                "view": {
+                    "users": [],
+                    "groups": []
+                },
+                "change": {
+                    "users": [],
+                    "groups": []
+                }
+            },
             "notes": []
         }
     ]

diff --git a/src-ui/cypress/fixtures/ui_settings/settings.json b/src-ui/cypress/fixtures/ui_settings/settings.json
index 3183943fe61f7a6624777ed213dcb677f89e22cb..b885eeccb7042ac3f000ce4a82ca9f98c2315f2f 100644 (file)
--- a/src-ui/cypress/fixtures/ui_settings/settings.json
+++ b/src-ui/cypress/fixtures/ui_settings/settings.json
@@ -2,7 +2,8 @@
     "user": {
         "id": 1,
         "username": "admin",
-        "is_superuser": true
+        "is_superuser": true,
+        "groups": []
     },
     "settings": {
         "language": "",

diff --git a/src-ui/cypress/fixtures/ui_settings/settings_restricted.json b/src-ui/cypress/fixtures/ui_settings/settings_restricted.json
index 72ebe51b1a108b2e16908c18e371cd4d348bc61d..1f7f61fdc81a02b7ca98bbcf836da163b14deeaf 100644 (file)
--- a/src-ui/cypress/fixtures/ui_settings/settings_restricted.json
+++ b/src-ui/cypress/fixtures/ui_settings/settings_restricted.json
@@ -2,7 +2,8 @@
     "user": {
         "id": 1,
         "username": "admin",
-        "is_superuser": false
+        "is_superuser": false,
+        "groups": []
     },
     "settings": {
         "language": "",

diff --git a/src-ui/src/app/components/common/input/select/select.component.ts b/src-ui/src/app/components/common/input/select/select.component.ts
index 0f65d76b661a088f68983bf5c647977e1cde8503..ddf900bf6b151aa082186999e8f85204b39114d2 100644 (file)
--- a/src-ui/src/app/components/common/input/select/select.component.ts
+++ b/src-ui/src/app/components/common/input/select/select.component.ts
@@ -77,7 +77,7 @@ export class SelectComponent extends AbstractInputComponent<number> {
   }
 
   get isPrivate(): boolean {
-    return this.items.find((i) => i.id === this.value)?.private
+    return this.items?.find((i) => i.id === this.value)?.private
   }
 
   getSuggestions() {

diff --git a/src-ui/src/app/data/paperless-user.ts b/src-ui/src/app/data/paperless-user.ts
index 125a2f50950a9f61dbfbef67f07debd21d6f8e63..1cd64ebf990faed8792904046454824f08e0c159 100644 (file)
--- a/src-ui/src/app/data/paperless-user.ts
+++ b/src-ui/src/app/data/paperless-user.ts
@@ -9,7 +9,7 @@ export interface PaperlessUser extends ObjectWithId {
   is_staff?: boolean
   is_active?: boolean
   is_superuser?: boolean
-  groups?: PaperlessGroup[]
+  groups?: number[] // PaperlessGroup[]
   user_permissions?: string[]
   inherited_permissions?: string[]
 }

diff --git a/src-ui/src/app/services/permissions.service.ts b/src-ui/src/app/services/permissions.service.ts
index e1ce9497736e1357784395d5be6fd78b6257a293..c19a4ee94705c6361b0a93ec75daf35eb7aa764d 100644 (file)
--- a/src-ui/src/app/services/permissions.service.ts
+++ b/src-ui/src/app/services/permissions.service.ts
@@ -58,11 +58,16 @@ export class PermissionsService {
     action: string,
     object: ObjectWithPermissions
   ): boolean {
+    let actionObject = null
+    if (action === PermissionAction.View) actionObject = object.permissions.view
+    else if (action === PermissionAction.Change)
+      actionObject = object.permissions.change
+    if (!actionObject) return false
     return (
       this.currentUserOwnsObject(object) ||
-      (object.permissions[action]['users'] as Array<number>)?.includes(
-        this.currentUser.id
-      )
+      actionObject.users.includes(this.currentUser.id) ||
+      actionObject.groups.filter((g) => this.currentUser.groups.includes(g))
+        .length > 0
     )
   }
 

diff --git a/src/documents/permissions.py b/src/documents/permissions.py
index c0e7ac345fcf17e09c4f5e2243f96f8303e086c8..c50cdc5b9e1d8d968ca747536f5ea93f31514a10 100644 (file)
--- a/src/documents/permissions.py
+++ b/src/documents/permissions.py
@@ -63,6 +63,7 @@ def set_permissions_for_object(permissions, object):
         users_to_remove = get_users_with_perms(
             object,
             only_with_perms_in=[permission],
+            with_group_users=False,
         )
         if len(users_to_add) > 0 and len(users_to_remove) > 0:
             users_to_remove = users_to_remove.difference(users_to_add)

diff --git a/src/documents/serialisers.py b/src/documents/serialisers.py
index 4e2fafe3443a619580ab6883646cd6e306b91d57..e1187b446fe687f0f5aed2df69d07257b01b12b5 100644 (file)
--- a/src/documents/serialisers.py
+++ b/src/documents/serialisers.py
@@ -161,6 +161,7 @@ class OwnedObjectSerializer(serializers.ModelSerializer, SetPermissionsMixin):
                 "users": get_users_with_perms(
                     obj,
                     only_with_perms_in=[view_codename],
+                    with_group_users=False,
                 ).values_list("id", flat=True),
                 "groups": get_groups_with_only_permission(
                     obj,
@@ -171,6 +172,7 @@ class OwnedObjectSerializer(serializers.ModelSerializer, SetPermissionsMixin):
                 "users": get_users_with_perms(
                     obj,
                     only_with_perms_in=[change_codename],
+                    with_group_users=False,
                 ).values_list("id", flat=True),
                 "groups": get_groups_with_only_permission(
                     obj,

diff --git a/src/documents/views.py b/src/documents/views.py
index 6a0eae051b8a7f3165b39cf2bfdca1fbf9efaa92..1b30ec770aaa9e0d49777010beb251bdf23b9147 100644 (file)
--- a/src/documents/views.py
+++ b/src/documents/views.py
@@ -964,6 +964,7 @@ class UiSettingsView(GenericAPIView):
                     "id": user.id,
                     "username": user.username,
                     "is_superuser": user.is_superuser,
+                    "groups": user.groups.values_list("id", flat=True),
                 },
                 "settings": ui_settings,
                 "permissions": roles,