Backport ACL computation improvements

Signed-off-by: Roberto Rosario <roberto.rosario.gonzalez@gmail.com>

mayan/apps/metadata/api_views.py

@@ -43,8 +43,8 @@ class APIDocumentMetadataListView(generics.ListCreateAPIView):
         )
 
         AccessControlList.objects.check_access(
-            permissions=permission_required, user=self.request.user,
-            obj=document
+            obj=document, permissions=(permission_required,),
+            user=self.request.user
         )
 
         return document
@@ -103,8 +103,8 @@ class APIDocumentMetadataView(generics.RetrieveUpdateDestroyAPIView):
         )
 
         AccessControlList.objects.check_access(
-            permissions=permission_required, user=self.request.user,
-            obj=document
+            obj=document, permissions=(permission_required,),
+            user=self.request.user
         )
 
         return document
@@ -175,8 +175,8 @@ class APIDocumentTypeMetadataTypeListView(generics.ListCreateAPIView):
         )
 
         AccessControlList.objects.check_access(
-            permissions=permission_required, user=self.request.user,
-            obj=document_type
+            obj=document_type, permissions=(permission_required,),
+            user=self.request.user
         )
 
         return document_type
@@ -232,8 +232,8 @@ class APIDocumentTypeMetadataTypeView(generics.RetrieveUpdateDestroyAPIView):
         )
 
         AccessControlList.objects.check_access(
-            permissions=permission_required, user=self.request.user,
-            obj=document_type
+            obj=document_type, permissions=(permission_required,),
+            user=self.request.user
         )
 
         return document_type

mayan/apps/metadata/views.py

@@ -397,8 +397,9 @@ class DocumentMetadataEditView(MultipleObjectFormActionView):
 class DocumentMetadataListView(SingleObjectListView):
     def dispatch(self, request, *args, **kwargs):
         AccessControlList.objects.check_access(
-            permissions=permission_metadata_document_view,
-            user=self.request.user, obj=self.get_document()
+            obj=self.get_document(),
+            permissions=(permission_metadata_document_view,),
+            user=self.request.user
         )
 
         return super(DocumentMetadataListView, self).dispatch(
@@ -725,8 +726,8 @@ class SetupDocumentTypeMetadataTypes(FormView):
         obj = get_object_or_404(klass=self.model, pk=self.kwargs['pk'])
 
         AccessControlList.objects.check_access(
-            permissions=(permission_metadata_type_edit,),
-            user=self.request.user, obj=obj
+            obj=obj, permissions=(permission_metadata_type_edit,),
+            user=self.request.user
         )
         return obj