diff --git a/loko/documents/permissions.py b/loko/documents/permissions.py index a3dc7ca..3918975 100644 --- a/loko/documents/permissions.py +++ b/loko/documents/permissions.py @@ -139,13 +139,13 @@ def user_has_document_permission( def user_is_documents_admin(user) -> bool: if user is None or not getattr(user, "is_authenticated", False): return False - if getattr(user, "is_superuser", False) or getattr(user, "is_staff", False): + if getattr(user, "is_superuser", False): return True config = getattr(user, "config", None) if config is None: return False - # Admins et top_managers peuvent tout voir - if config.roles.filter(name__in=["admin", "top_manager"]).exists(): + # Seuls les admins ont tous les droits d'administration sur les répertoires et documents + if config.roles.filter(name="admin").exists(): return True return False diff --git a/loko/documents/tests.py b/loko/documents/tests.py index da13a9e..2042957 100644 --- a/loko/documents/tests.py +++ b/loko/documents/tests.py @@ -15,6 +15,7 @@ from .permissions import ( filter_folders_for_user, get_user_visible_folder_ids, user_has_document_permission, + user_is_documents_admin, ) @@ -110,6 +111,30 @@ class DocumentPermissionTests(TestCase): self.assertIn(self.folder.pk, visible) self.assertIn(self.parent_folder.pk, visible) + def test_admin_role_is_documents_admin_and_sees_all_folders(self): + admin_user = User.objects.create_user(username="admin_role_user", password="pwd") + admin_config = UserConfig.objects.create(user=admin_user, is_intern=True) + admin_role, _ = Role.objects.get_or_create(name="admin") + admin_config.roles.add(admin_role) + + self.assertTrue(user_is_documents_admin(admin_user)) + queryset = DocumentFolder.objects.all() + filtered = filter_folders_for_user(queryset, admin_user) + self.assertEqual(set(filtered.values_list("pk", flat=True)), set(queryset.values_list("pk", flat=True))) + + def test_top_manager_is_not_documents_admin_and_does_not_see_all_folders(self): + tm_user = User.objects.create_user(username="top_manager_user", password="pwd") + tm_config = UserConfig.objects.create(user=tm_user, is_intern=True) + tm_role, _ = Role.objects.get_or_create(name="top_manager") + tm_config.roles.add(tm_role) + + self.assertFalse(user_is_documents_admin(tm_user)) + queryset = DocumentFolder.objects.all() + filtered = filter_folders_for_user(queryset, tm_user) + # tm_user has no owned folders, shares, or thematics, so they should see no folders + self.assertEqual(set(filtered.values_list("pk", flat=True)), set()) + + class DocumentListViewTests(TestCase): def setUp(self):