feat: implement document and folder permission logic and associated unit tests

loko/documents/permissions.py

@@ -139,13 +139,13 @@ def user_has_document_permission(
 def user_is_documents_admin(user) -> bool:
     if user is None or not getattr(user, "is_authenticated", False):
         return False
-    if getattr(user, "is_superuser", False) or getattr(user, "is_staff", False):
+    if getattr(user, "is_superuser", False):
         return True
     config = getattr(user, "config", None)
     if config is None:
         return False
-    # Admins et top_managers peuvent tout voir
-    if config.roles.filter(name__in=["admin", "top_manager"]).exists():
+    # Seuls les admins ont tous les droits d'administration sur les répertoires et documents
+    if config.roles.filter(name="admin").exists():
         return True
     return False
 

loko/documents/tests.py

@@ -15,6 +15,7 @@ from .permissions import (
     filter_folders_for_user,
     get_user_visible_folder_ids,
     user_has_document_permission,
+    user_is_documents_admin,
 )
 
 
@@ -110,6 +111,30 @@ class DocumentPermissionTests(TestCase):
         self.assertIn(self.folder.pk, visible)
         self.assertIn(self.parent_folder.pk, visible)
 
+    def test_admin_role_is_documents_admin_and_sees_all_folders(self):
+        admin_user = User.objects.create_user(username="admin_role_user", password="pwd")
+        admin_config = UserConfig.objects.create(user=admin_user, is_intern=True)
+        admin_role, _ = Role.objects.get_or_create(name="admin")
+        admin_config.roles.add(admin_role)
+
+        self.assertTrue(user_is_documents_admin(admin_user))
+        queryset = DocumentFolder.objects.all()
+        filtered = filter_folders_for_user(queryset, admin_user)
+        self.assertEqual(set(filtered.values_list("pk", flat=True)), set(queryset.values_list("pk", flat=True)))
+
+    def test_top_manager_is_not_documents_admin_and_does_not_see_all_folders(self):
+        tm_user = User.objects.create_user(username="top_manager_user", password="pwd")
+        tm_config = UserConfig.objects.create(user=tm_user, is_intern=True)
+        tm_role, _ = Role.objects.get_or_create(name="top_manager")
+        tm_config.roles.add(tm_role)
+
+        self.assertFalse(user_is_documents_admin(tm_user))
+        queryset = DocumentFolder.objects.all()
+        filtered = filter_folders_for_user(queryset, tm_user)
+        # tm_user has no owned folders, shares, or thematics, so they should see no folders
+        self.assertEqual(set(filtered.values_list("pk", flat=True)), set())
+
+
 
 class DocumentListViewTests(TestCase):
     def setUp(self):