From 1b1fb87eace1783737eab74a791535961c95729c Mon Sep 17 00:00:00 2001
From: Roberto Rosario <roberto.rosario.gonzalez@gmail.com>
Date: Wed, 9 Jul 2014 16:46:55 -0400
Subject: [PATCH] Enable custom permission checking and api result filering

---
 mayan/apps/documents/api.py | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/mayan/apps/documents/api.py b/mayan/apps/documents/api.py
index 8bc2e4b204..cbd1d61cfc 100644
--- a/mayan/apps/documents/api.py
+++ b/mayan/apps/documents/api.py
@@ -9,10 +9,14 @@ from rest_framework import generics
 from rest_framework.response import Response
 
 from acls.models import AccessEntry
+from permissions.models import Permission
+
 from converter.exceptions import UnknownFileFormat, UnkownConvertError
 from converter.literals import (DEFAULT_ZOOM_LEVEL, DEFAULT_ROTATION,
     DEFAULT_PAGE_NUMBER)
 from permissions.models import Permission
+from rest_api.filters import MayanObjectPermissionsFilter
+from rest_api.permissions import MayanPermission
 
 from .conf.settings import DISPLAY_SIZE, ZOOM_MAX_LEVEL, ZOOM_MIN_LEVEL
 from .models import Document, DocumentVersion, DocumentPage
@@ -33,6 +37,9 @@ class APIDocumentListView(generics.ListAPIView):
     serializer_class = DocumentSerializer
     queryset = Document.objects.all()
 
+    filter_backends = (MayanObjectPermissionsFilter,)
+    mayan_object_permissions = [PERMISSION_DOCUMENT_VIEW]
+
 
 class APIDocumentPageView(generics.RetrieveAPIView):
     """
@@ -43,6 +50,10 @@ class APIDocumentPageView(generics.RetrieveAPIView):
     serializer_class = DocumentPageSerializer
     queryset = DocumentPage.objects.all()
 
+    permission_classes = (MayanPermission,)
+    mayan_object_permissions = [PERMISSION_DOCUMENT_VIEW]
+    mayan_permission_attribute_check = 'document'
+
 
 class APIDocumentView(generics.RetrieveAPIView):
     """
@@ -53,6 +64,9 @@ class APIDocumentView(generics.RetrieveAPIView):
     serializer_class = DocumentSerializer
     queryset = Document.objects.all()
 
+    permission_classes = (MayanPermission,)
+    mayan_object_permissions = [PERMISSION_DOCUMENT_VIEW]
+
 
 class APIDocumentVersionView(generics.RetrieveAPIView):
     """
@@ -63,6 +77,10 @@ class APIDocumentVersionView(generics.RetrieveAPIView):
     serializer_class = DocumentVersionSerializer
     queryset = DocumentVersion.objects.all()
 
+    permission_classes = (MayanPermission,)
+    mayan_object_permissions = [PERMISSION_DOCUMENT_VIEW]
+    mayan_permission_attribute_check = 'document'
+
 
 class APIDocumentImageView(generics.GenericAPIView):
     """