Backport ACL computation improvements

Signed-off-by: Roberto Rosario <roberto.rosario.gonzalez@gmail.com>

mayan/apps/cabinets/api_views.py

@@ -35,8 +35,8 @@ class APIDocumentCabinetListView(generics.ListAPIView):
     def get_queryset(self):
         document = get_object_or_404(klass=Document, pk=self.kwargs['pk'])
         AccessControlList.objects.check_access(
-            permissions=permission_document_view, user=self.request.user,
-            obj=document
+            obj=document, permissions=(permission_document_view,),
+            user=self.request.user
         )
 
         queryset = document.get_cabinets()
@@ -189,8 +189,8 @@ class APICabinetDocumentView(generics.RetrieveDestroyAPIView):
         instance = self.get_object()
 
         AccessControlList.objects.check_access(
-            permissions=permission_document_view, user=self.request.user,
-            obj=instance
+            obj=instance, permissions=(permission_document_view,),
+            user=self.request.user
         )
 
         serializer = self.get_serializer(instance)

mayan/apps/cabinets/apps.py

@@ -73,8 +73,16 @@ class CabinetsApp(MayanAppConfig):
                 permission_cabinet_remove_document
             )
         )
-        ModelPermission.register_inheritance(
-            model=Cabinet, related='get_root',
+
+        def get_root_filter():
+            return {
+                'acl_filter': {'level': 0},
+                'acl_values': ('tree_id',),
+                'field_lookup': 'tree_id__in'
+            }
+
+        ModelPermission.register_function(
+            model=Cabinet, function=get_root_filter
         )
 
         SourceColumn(

mayan/apps/cabinets/views.py

@@ -63,7 +63,7 @@ class CabinetChildAddView(SingleObjectCreateView):
         cabinet = super(CabinetChildAddView, self).get_object(*args, **kwargs)
 
         AccessControlList.objects.check_access(
-            obj=cabinet.get_root(), permissions=permission_cabinet_edit,
+            obj=cabinet.get_root(), permissions=(permission_cabinet_edit,),
             user=self.request.user
         )
 
@@ -142,7 +142,7 @@ class CabinetDetailView(DocumentListView):
             permission_object = cabinet.get_root()
 
         AccessControlList.objects.check_access(
-            obj=permission_object, permissions=permission_cabinet_view,
+            obj=permission_object, permissions=(permission_cabinet_view,),
             user=self.request.user
         )
 
@@ -193,7 +193,7 @@ class DocumentCabinetListView(CabinetListView):
         self.document = get_object_or_404(klass=Document, pk=self.kwargs['pk'])
 
         AccessControlList.objects.check_access(
-            obj=self.document, permissions=permission_document_view,
+            obj=self.document, permissions=(permission_document_view,),
             user=request.user
         )
 
@@ -288,7 +288,7 @@ class DocumentAddToCabinetView(MultipleObjectFormActionView):
 
         for cabinet in form.cleaned_data['cabinets']:
             AccessControlList.objects.check_access(
-                obj=cabinet, permissions=permission_cabinet_add_document,
+                obj=cabinet, permissions=(permission_cabinet_add_document,),
                 user=self.request.user
             )
             if cabinet in cabinet_membership:
@@ -376,7 +376,7 @@ class DocumentRemoveFromCabinetView(MultipleObjectFormActionView):
 
         for cabinet in form.cleaned_data['cabinets']:
             AccessControlList.objects.check_access(
-                obj=cabinet, permissions=permission_cabinet_remove_document,
+                obj=cabinet, permissions=(permission_cabinet_remove_document,),
                 user=self.request.user
             )