From 39af4f9f8aa3b335306f09a7ec19cd60a1d7aa4e Mon Sep 17 00:00:00 2001
From: Roberto Rosario <roberto.rosario.gonzalez@gmail.com>
Date: Fri, 31 May 2019 00:24:14 -0400
Subject: [PATCH] Fix trashed document previews

Signed-off-by: Roberto Rosario <roberto.rosario.gonzalez@gmail.com>
---
 mayan/apps/documents/api_views.py      |  2 +-
 mayan/apps/documents/tests/test_api.py | 28 ++++++++++++++++++++++++++
 2 files changed, 29 insertions(+), 1 deletion(-)

diff --git a/mayan/apps/documents/api_views.py b/mayan/apps/documents/api_views.py
index 4e047c0b07..c42a8d50c2 100644
--- a/mayan/apps/documents/api_views.py
+++ b/mayan/apps/documents/api_views.py
@@ -165,7 +165,7 @@ class APIDocumentPageImageView(generics.RetrieveAPIView):
 
         AccessControlList.objects.check_access(
             obj=document, permissions=(permission_required,),
-            user=self.request.user
+            user=self.request.user, manager=Document.passthrough
         )
         return document
 
diff --git a/mayan/apps/documents/tests/test_api.py b/mayan/apps/documents/tests/test_api.py
index e247781126..0ddcc9164f 100644
--- a/mayan/apps/documents/tests/test_api.py
+++ b/mayan/apps/documents/tests/test_api.py
@@ -627,6 +627,34 @@ class TrashedDocumentAPITestCase(DocumentTestMixin, BaseAPITestCase):
             response.data['uuid'], force_text(self.test_document.uuid)
         )
 
+    def _request_trashed_document_image_view(self):
+        latest_version = self.test_document.latest_version
+
+        return self.get(
+            viewname='rest_api:documentpage-image', kwargs={
+                'pk': latest_version.document.pk,
+                'version_pk': latest_version.pk,
+                'page_pk': latest_version.pages.first().pk
+            }
+        )
+
+    def test_trashed_document_image_view_no_permission(self):
+        self.upload_document()
+        self.test_document.delete()
+
+        response = self._request_trashed_document_image_view()
+        self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
+
+    def test_trashed_document_image_view_with_access(self):
+        self.upload_document()
+        self.test_document.delete()
+        self.grant_access(
+            obj=self.test_document, permission=permission_document_view
+        )
+
+        response = self._request_trashed_document_image_view()
+        self.assertEqual(response.status_code, status.HTTP_200_OK)
+
     def _request_trashed_document_list_view(self):
         return self.get(
             viewname='rest_api:trasheddocument-list'