From 9f3f41f39e1d4b175be4617a76dc8f2fc50d896c Mon Sep 17 00:00:00 2001
From: Michael Price <loneviking72@gmail.com>
Date: Sat, 17 Feb 2018 03:04:06 -0400
Subject: [PATCH] Update the tag API tests to test against permission and
 access success and failure. Update tag API test to conform to new API test
 class interface.

Signed-off-by: Michael Price <loneviking72@gmail.com>
---
 docs/topics/.development.rst.swp  | Bin 16384 -> 0 bytes
 mayan/apps/tags/tests/test_api.py | 376 +++++++++++++++++++++---------
 2 files changed, 270 insertions(+), 106 deletions(-)
 delete mode 100644 docs/topics/.development.rst.swp

diff --git a/docs/topics/.development.rst.swp b/docs/topics/.development.rst.swp
deleted file mode 100644
index 57cb51857dff03e491befe21c07097c23b2c178d..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 16384
zcmeI3U5q5xRmaQ3;5gU>90dp;(#31EJFD*Mnb~!+9*ALfKGq}cu7{nO^{!)6Q{8pD
zyLPIpYU^Wq+JcankB3MB9*Gh=FQ6b$fINVW9f?S`6C@CF9+C%;lHiDh2Z+f-fJDUb
zJGX9i_sotR5FjMfZU47ts_s2??*E*7?m4G>+VfX8E~#_wyu<7J9Vh(9-@g8p+wXDS
zf6;NWB=@s0$>i1>z0%IY!kKe#G@`oq-dbQQ(EB<{(t(bP*1#Y6aZ?9_yqW7P)OmB!
zJ!l0<CvO!=8uB(Z+RgIfJ3nYPV#dIXfnylB+c~qiV7B^+dw)W`?Vg=u#>_6w7??3I
zV_?R>jDZ;gGX`c1%ovz4@c)&8BE8-DB^LKxc7a3te%q1vf48rZy?$`y{%iJrWUqhy
z$o)6j-=DPakJ|^-&#{+hZ!-pF49pmqF)(9b#=wk$83Qv0W(>?2m@zP8V8+1z0t0^F
zINy!jZ%ZN0=l^y6|LR*E=WE~<@Okh#@ay1%;5_)o_c_krf-iyJ13wQQ2akaZU=b{U
zzrWjY{uDe5La+nw1h3uYIDZ5Ja4)z6JoCMd^M_y${1~_keDW=h^Ay+wZv&sX6FHy{
z-T}V!X2<y=_yYI~@GN)+{66?7cpN+iE`W9Lqu@utJ>V_iPVn_R9Os|F=fU&fcfbcg
z2{Z`6d%&Y$4XlE9fFB0m`X1H@z6w4GeiwWUd=T6KXTWXXB}je|d<bOVCfEfFU>@8J
z{^54V`80SM{1)hfhrnInWf~|S2Ok4I*abfTUZQa`0ta9KBJc>f3U<IEcr&;IyoQa%
z&i^)Ux~wEwraQ%w<0xL;EEy=icu~stGIDp21Ukx9I7pMMP^<R38F^wdO!;Z5_Cr0)
z-E^eP96ZT&Rfp-#c9eAXmX=i8&-;$E5qHK9EV8h(*HD?x<)<P{Vs%QpJ-4B*lyMOb
zw8#p(VaGT3lCCQH=2{u)lezK>rnSpL=X0*p*2wAVOvfD^C_h(GSQL?#pVB1H!*-+_
zs*EF@=M21Ah8e@!Bju|+)g5_=>T16zGu?2Oqe!8&ADM-r1JAP@@YIZ-V`M~VwXan-
z$p)^vcyxH|qkfpHBAFug2%j5qpbr|#ylupJ;iLOyC~J(FzM@6WN&+2*^f~h{c4A$*
z9<V4cFT36FKnGqojLhiqkZ$f_JzZ$8HmDbcF@#TUgrb2LKt`uXvQcAtZYP5e?HwH=
zv+b?JV$EFRKdz{fkMcqfYS%e6bypvBbSf4dJJu!tV9PAStn`ZZJAECP8IuKHTE6CO
z?X0hFT=P~Q-nqQpP+J#wE^Mq{_coWeAKDsgzI=6g<Kpu9i)-G-<<+%o8<#J5>pPcM
zwl^NWyj88Q(y^1oT{qW75yri-B9)parp#Hney&c{2A`X<=Rg;J;1|BziNqdbF_-N1
z6}fCQJE1Pgcbvqb@+kr0`d&A~#=|7rtI1m4+_=havJ=l_flB?X7~yvKNEG3?t2g|(
zm*C^=jIU?uX_0}s<(5Sl<!+JraW0O^*0P(p?6GEjP<WC51n!?J&pfBv`2Wedx6HuO
zDUZ=^pu2t<6*xelvoRleRQAH|=$2_g`^b*?IlE@NK0-yk-|Z6ZB4h_cUCr%r6m5=*
zKC3=Lk)2O0((gQLAGXED3w&5UG=(m=;$?X8ylyF>!SiYs{dS&2gdVRF_<GT9?ZAf^
zO>k{mpQ^^^{9ZZ4+Ulh(33G%PxoE<`w23FT2-LbZ{N(Cng4KR<>*%`bJI+QG&XX+A
znacY~84(Ia$@f+-JHS$YpXx^bo<66V&9E1v#Jkt-pI>OKEi9gse-_m*NKkz}1|I3_
zm~Z-JQ&E_Z&Djy3EL75F)8s0V`$gYu#3<a;7%k=>9rud<QmvGz=By`ClnmA8+9uyM
zY~J#6RyZ%>9_LQH&-o=GhJ#4VC?^!r*u;823ZIZOA`VobQym9r5Syc=4roOAG<BKS
zRJ8?F9ul3|f&@%?#Ho606(G4Zhm?pNm8KCplE6PXAR8iG6zM?*N8R+PR2?Qg@js@>
z0heaU4dSs;(2o-?Wk&yD$hp+c!l0+kxNaGnLzDFsBUhZK%ba?t1MSC!h~#7}^Xjl0
zhzk{c1|<+YmfTQbG4TVGLsNDLdfJoHBm+w-_V>e{2__Ad>TD2lu0nAGz6XOOZm5AD
z#-hj?0le0O2qUBk&zQt4D%Vk0Y*a8@3^6&PUHGmKhl(_%V1VSp=d9y<qOuEHniH=R
zB2AvPLPRvn3}X`tD=Q3fJ0VF9>l_hwv7LSrV#P$<P1pOqx@b;z7H)&AS*FO}%#!^u
z(CU@<eI&>@@U#4t_dO*N@?ltX`l1(Pb@q%OK{x8)p)gMP<JYdZa#6}ZxIj}~PE=oP
zT{FTujQh1~^=*#wdb*2Oa<Jl^6V>d_m!JllZL%r9%BFI0C?C>!oQccz>Qq*8`mzAb
zB%a-iG;&XgW<wI3hI)9b!DEul?`e{&rdrN(QbIA+t$7uXOxV(XOvII~!7sTmCKOv=
zMmTwrHG<vg+#c0l2VG`3Ctu5+rLEe%p{G0X)!b-f*C_f7O7XRc3pJFa561fjWnPH;
z<L~+ahb?5U-H?mo{zeVS2&~0LuyI_m9b)ZVu`hO%bRq2Fea3@3+)W0A5!pH1Wi4T*
zVy%fKewU*Uu@Bt;lcKpSt%GHZ;_K5}cJd5X;b(igXyqmkL!;U~pmlm_l298ac_4*a
ze^jla%1VXrp)Z#p)~2bGLuSc&2){JCk_1|tO>Qf*V}e8sh*!rwaZBP(U;=8ahjn_K
z|I~4jx7l>qC?;&B{V+=Mgf}hGmomWHy$}``{We=MFJTk++|$|alIj;lnlH6ly|9S<
zwo4e9`YQPJk7i<SWL2X63v(&9s%!zPt7^9AI+ZFm?jNt8=c?^Q<z;(-kyD?|u8DOV
z=U7wa?05FgKxaMe5O_yP$;PH0@N1$>@FYoLBb7bqtZJA{waXs2q@WrLONfq4gk{H>
zG6|8Z#1pUr+ZoYQUxIH`Zb%F@C6Gy`#pFXB!J>8@=iQT+vpV^%ePxg-NlT8@|5vCD
z_o*?Z{(q7;dHo$V{$GNZz>DAokb#>Z1#Pemw!j_WS!(?P<ltw(gWy%_{Lg}y!E-?R
z05`x{a0Yytn*Vw595?{mU<+IU4}#NR4!j-Q1|0A_J%Q(d^ayT%>);w#20sfHf%Fc(
zO|Re+;5R`AZh{oF!8X_ebKn&CXZi@=0DlgozwjsEkHOR6DexO$1Re#qgD=xFcnQ1+
zUI3o}(rb7cY=VEGFYs0H74TQ!8Sr87%iu}yevp92!DC<vJOHGh@I&C6^b7tK{0;bP
z@G0<T;G^Ja@N3{ESOq^0zD4igo8YtHW$*{!<KS1puYkJWu+GnGpa~k_2f^FHtJwZ)
z;6?BP_z3tg5T7W)>@{QHf0hBo>psps(tS#6iK!l0p0p}B8@#ej%cG<>cE(lb%a8&^
z()BWp5?{hDSry$GJ8#MMu8v5fFH{^Wa`9M^GW=GFoJ=Y$^FGB-;rBSt78YE!DHr$^
zeaN-6KbUAB<K<4%SNqr8>+YkfIZ*drB^i_w++4XAA@dw9jFN1U>yzn*4x>27aTFb=
z{sXo4jL;G1QfH4O&CnwgkCT-L;qg?Qt7YX$nUNPCBkWx=WI%h*E`bbccOb2dmPh3i
z7M@4XZ`XOJt9DXaA!1C^Tr(xZp;`1=%G3<Le>}L#G@_*EI%i$=NER9a)d@@9FG&-b
z)Yws`+8H#Vl0izJiF3qNE7i}ETGaiH{3sJsx4g8BA`S{yZH?kiKTBds<&K~1l83}F
zY+9Rm>mcl9rZ^C1;K_a6*)u7bDTm0OCIdtRTT)NnoGX>LlVve8!ZPeD97C3=PN?;1
z&z9?1=dxU{XRWXgLLpl2wYkN;^R%04*OkkDb$K~T`;+Sqsh{*JDF;Xp2d-0FG%g2i
zDOUU_L3>jZR0RbsRtoLr{Mobflm<3c8xDssA*~fR$$BjkiB_u9T>dd5TXWMH49PE5
z5P9jAhQ)%4(ryJwGmT8LKN^|nV#LjnP$Aot!jxr6j(I24*`FLMLsgn13I>He2>|sU
z5{kK`$k7?HkG(728~TxPOFJM9=@L{;HuckFe0@paMSapn2&R!7N}Ke-mTaghKlRLC
zEgrZd_lagYT5QIY7EMYaci4}tRJ*z8NbI*L^I9gG6ALO{_fgwsMd{P+*k`-M`}S%l
zP_1H+8t-1Es#GRES>=wnwuuDBomWiHR&x2N&`?T&XO<!1MS8Q7`O_<IW`{Pf*tY%)
zO}99}O>y@P%Z`vTb^p-BTio7xWLls9Lt|BcVrq=#7JlaTp0I5H_e?|_`A#M>A=of@
zL0Ui(D1|~BaD#E6JY||ZRLwz2Jf67Ot(wmX&D(uy1pXIUxl}pQqrzvULr`^n*!8tE
z%3$k1rfFfHeO!#9)3#Ne2;wcZmdDn8j`fIXkyu!&zAZ|?_@JuPWSg5`-8AVWiEQ?&
zGR*W=k(C|k>jY|>zO*e1nIIiD)5Wf=L+~OB$5hGu0kGRI21M}c5#G4dR&~0i)nHm(
z0fAB4;LdfbvkvQLyC+o>uC_qk#;ay>x>Yff;ulV(O~kB+wl7_jGbYYyZ41}r?$mK3
znsLdn+FVuVZg&@PdCO}{#?lfMcXu(O{dC2}TzdR;T0r*WwCd5K9=!_r7!4+l2$$#!
zBMXb~a_9MPVd>obJb%MU{HSv%d9Y`q9UmIXhj`)=r%%h})2Amo;4~;fs}8>~T9P=J
z^^HByM!ZAH@flrNbx6CW0c)BB^!zxBY9-z<kW4SM3MJhTBbtVZXky*c=zQqGN(TgK
zqF3DyG3_!rqgaSFepL$dNeVqD=`|WDl_d_bPwb+jA?5UV?I9(&6z;O=jByS>oQ*Xk
zB`GM*CGEM@RXyu16!KZpp_Ps0M7bk7#aW#u!0wJ+vYwtH(og+%NL!75$y84SRdTob
zFbCn%Suy<)9h)=P{#m@0VMFRKPCmao8A<RyxpZ=M?flM#lT$YkmilyY^~oi*ot1pt
F`5!SsZ)X4i

diff --git a/mayan/apps/tags/tests/test_api.py b/mayan/apps/tags/tests/test_api.py
index 97f8752f62..ba05f45704 100644
--- a/mayan/apps/tags/tests/test_api.py
+++ b/mayan/apps/tags/tests/test_api.py
@@ -1,18 +1,20 @@
 from __future__ import unicode_literals
 
-from django.contrib.auth import get_user_model
 from django.test import override_settings
-from django.urls import reverse
 from django.utils.encoding import force_text
 
+from rest_framework import status
+
 from documents.models import DocumentType
+from documents.permissions import permission_document_view
 from documents.tests import TEST_DOCUMENT_TYPE_LABEL, TEST_SMALL_DOCUMENT_PATH
 from rest_api.tests import BaseAPITestCase
-from user_management.tests.literals import (
-    TEST_ADMIN_EMAIL, TEST_ADMIN_PASSWORD, TEST_ADMIN_USERNAME
-)
 
 from ..models import Tag
+from ..permissions import (
+    permission_tag_attach, permission_tag_create, permission_tag_delete,
+    permission_tag_edit, permission_tag_remove, permission_tag_view
+)
 
 from .literals import (
     TEST_TAG_COLOR, TEST_TAG_COLOR_EDITED, TEST_TAG_LABEL,
@@ -24,14 +26,7 @@ from .literals import (
 class TagAPITestCase(BaseAPITestCase):
     def setUp(self):
         super(TagAPITestCase, self).setUp()
-        self.admin_user = get_user_model().objects.create_superuser(
-            username=TEST_ADMIN_USERNAME, email=TEST_ADMIN_EMAIL,
-            password=TEST_ADMIN_PASSWORD
-        )
-
-        self.client.login(
-            username=TEST_ADMIN_USERNAME, password=TEST_ADMIN_PASSWORD
-        )
+        self.login_user()
 
     def tearDown(self):
         if hasattr(self, 'document_type'):
@@ -39,7 +34,9 @@ class TagAPITestCase(BaseAPITestCase):
         super(TagAPITestCase, self).tearDown()
 
     def _create_tag(self):
-        return Tag.objects.create(color=TEST_TAG_COLOR, label=TEST_TAG_LABEL)
+        return Tag.objects.create(
+            color=TEST_TAG_COLOR, label=TEST_TAG_LABEL
+        )
 
     def _document_create(self):
         self.document_type = DocumentType.objects.create(
@@ -53,130 +50,297 @@ class TagAPITestCase(BaseAPITestCase):
 
         return document
 
-    def test_tag_create_view(self):
-        response = self.client.post(
-            reverse('rest_api:tag-list'), {
+    def _request_tag_create(self):
+        return self.post(
+            viewname='rest_api:tag-list', data={
                 'label': TEST_TAG_LABEL, 'color': TEST_TAG_COLOR
             }
         )
 
-        tag = Tag.objects.first()
-        self.assertEqual(response.data['id'], tag.pk)
-        self.assertEqual(response.data['label'], TEST_TAG_LABEL)
-        self.assertEqual(response.data['color'], TEST_TAG_COLOR)
-
-        self.assertEqual(Tag.objects.count(), 1)
-        self.assertEqual(tag.label, TEST_TAG_LABEL)
-        self.assertEqual(tag.color, TEST_TAG_COLOR)
-
-    def test_tag_create_with_documents_view(self):
-        response = self.client.post(
-            reverse('rest_api:tag-list'), {
-                'label': TEST_TAG_LABEL, 'color': TEST_TAG_COLOR
-            }
-        )
-
-        tag = Tag.objects.first()
-        self.assertEqual(response.data['id'], tag.pk)
-        self.assertEqual(response.data['label'], TEST_TAG_LABEL)
-        self.assertEqual(response.data['color'], TEST_TAG_COLOR)
-
-        self.assertEqual(Tag.objects.count(), 1)
-        self.assertEqual(tag.label, TEST_TAG_LABEL)
-        self.assertEqual(tag.color, TEST_TAG_COLOR)
-
-    def test_tag_delete_view(self):
-        tag = self._create_tag()
-
-        self.client.delete(reverse('rest_api:tag-detail', args=(tag.pk,)))
-
+    def test_tag_create_view_no_permission(self):
+        response = self._request_tag_create()
+        self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
         self.assertEqual(Tag.objects.count(), 0)
 
-    def test_tag_document_list_view(self):
-        tag = self._create_tag()
-        document = self._document_create()
-        tag.documents.add(document)
+    def test_tag_create_view_with_permission(self):
+        self.grant_permission(permission=permission_tag_create)
+        response = self._request_tag_create()
+        self.assertEqual(response.status_code, status.HTTP_201_CREATED)
 
-        response = self.client.get(
-            reverse('rest_api:tag-document-list', args=(tag.pk,))
+        tag = Tag.objects.first()
+        self.assertEqual(response.data['id'], tag.pk)
+        self.assertEqual(response.data['label'], TEST_TAG_LABEL)
+        self.assertEqual(response.data['color'], TEST_TAG_COLOR)
+
+        self.assertEqual(Tag.objects.count(), 1)
+        self.assertEqual(tag.label, TEST_TAG_LABEL)
+        self.assertEqual(tag.color, TEST_TAG_COLOR)
+
+    def _request_tag_delete(self):
+        return self.delete(viewname='rest_api:tag-detail', args=(self.tag.pk,))
+
+    def test_tag_delete_view_no_access(self):
+        self.tag = self._create_tag()
+        response = self._request_tag_delete()
+        self.assertEqual(response.status_code, status.HTTP_404_NOT_FOUND)
+        self.assertTrue(self.tag in Tag.objects.all())
+
+    def test_tag_delete_view_with_access(self):
+        self.tag = self._create_tag()
+        self.grant_access(permission=permission_tag_delete, obj=self.tag)
+        response = self._request_tag_delete()
+        self.assertEqual(response.status_code, status.HTTP_204_NO_CONTENT)
+        self.assertFalse(self.tag in Tag.objects.all())
+
+    def _request_tag_document_list_view(self):
+        return self.get(
+            viewname='rest_api:tag-document-list', args=(self.tag.pk,)
         )
 
+    def test_tag_document_list_view_no_access(self):
+        self.tag = self._create_tag()
+        document = self._document_create()
+        self.tag.documents.add(document)
+
+        response = self._request_tag_document_list_view()
+        self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
+
+    def test_tag_document_list_view_with_tag_access(self):
+        self.tag = self._create_tag()
+        document = self._document_create()
+        self.tag.documents.add(document)
+        self.grant_access(permission=permission_tag_view, obj=self.tag)
+        response = self._request_tag_document_list_view()
+        self.assertEqual(response.status_code, status.HTTP_200_OK)
+        self.assertEqual(response.data['count'], 0)
+
+    def test_tag_document_list_view_with_document_access(self):
+        self.tag = self._create_tag()
+        document = self._document_create()
+        self.tag.documents.add(document)
+        self.grant_access(permission=permission_document_view, obj=document)
+        response = self._request_tag_document_list_view()
+        self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
+
+    def test_tag_document_list_view_with_access(self):
+        self.tag = self._create_tag()
+        document = self._document_create()
+        self.tag.documents.add(document)
+        self.grant_access(permission=permission_tag_view, obj=self.tag)
+        self.grant_access(permission=permission_document_view, obj=document)
+        response = self._request_tag_document_list_view()
+        self.assertEqual(response.status_code, status.HTTP_200_OK)
         self.assertEqual(
             response.data['results'][0]['uuid'], force_text(document.uuid)
         )
 
-    def test_tag_edit_via_patch(self):
-        tag = self._create_tag()
-
-        self.client.patch(
-            reverse('rest_api:tag-detail', args=(tag.pk,)),
-            {
+    def _request_tag_edit_via_patch(self):
+        return self.patch(
+            viewname='rest_api:tag-detail', args=(self.tag.pk,), data={
                 'label': TEST_TAG_LABEL_EDITED,
                 'color': TEST_TAG_COLOR_EDITED
             }
         )
 
-        tag.refresh_from_db()
+    def test_tag_edit_via_patch_no_access(self):
+        self.tag = self._create_tag()
+        response = self._request_tag_edit_via_patch()
+        self.assertEqual(response.status_code, status.HTTP_404_NOT_FOUND)
+        self.tag.refresh_from_db()
+        self.assertEqual(self.tag.label, TEST_TAG_LABEL)
+        self.assertEqual(self.tag.color, TEST_TAG_COLOR)
 
-        self.assertEqual(tag.label, TEST_TAG_LABEL_EDITED)
-        self.assertEqual(tag.color, TEST_TAG_COLOR_EDITED)
+    def test_tag_edit_via_patch_with_access(self):
+        self.tag = self._create_tag()
+        self.grant_access(permission=permission_tag_edit, obj=self.tag)
+        response = self._request_tag_edit_via_patch()
+        self.assertEqual(response.status_code, status.HTTP_200_OK)
+        self.tag.refresh_from_db()
+        self.assertEqual(self.tag.label, TEST_TAG_LABEL_EDITED)
+        self.assertEqual(self.tag.color, TEST_TAG_COLOR_EDITED)
 
-    def test_tag_edit_via_put(self):
-        tag = self._create_tag()
-
-        self.client.put(
-            reverse('rest_api:tag-detail', args=(tag.pk,)),
-            {
+    def _request_tag_edit_via_put(self):
+        return self.put(
+            viewname='rest_api:tag-detail', args=(self.tag.pk,), data={
                 'label': TEST_TAG_LABEL_EDITED,
                 'color': TEST_TAG_COLOR_EDITED
             }
         )
 
-        tag.refresh_from_db()
+    def test_tag_edit_via_put_no_access(self):
+        self.tag = self._create_tag()
+        response = self._request_tag_edit_via_put()
+        self.assertEqual(response.status_code, status.HTTP_404_NOT_FOUND)
+        self.tag.refresh_from_db()
+        self.assertEqual(self.tag.label, TEST_TAG_LABEL)
+        self.assertEqual(self.tag.color, TEST_TAG_COLOR)
 
-        self.assertEqual(tag.label, TEST_TAG_LABEL_EDITED)
-        self.assertEqual(tag.color, TEST_TAG_COLOR_EDITED)
+    def test_tag_edit_via_put_with_access(self):
+        self.tag = self._create_tag()
+        self.grant_access(permission=permission_tag_edit, obj=self.tag)
+        response = self._request_tag_edit_via_put()
+        self.assertEqual(response.status_code, status.HTTP_200_OK)
+        self.tag.refresh_from_db()
+        self.assertEqual(self.tag.label, TEST_TAG_LABEL_EDITED)
+        self.assertEqual(self.tag.color, TEST_TAG_COLOR_EDITED)
 
-    def test_document_attach_tag_view(self):
-        tag = self._create_tag()
-        document = self._document_create()
-
-        self.client.post(
-            reverse('rest_api:document-tag-list', args=(document.pk,)),
-            {'tag_pk': tag.pk}
-        )
-        self.assertQuerysetEqual(document.tags.all(), (repr(tag),))
-
-    def test_document_tag_detail_view(self):
-        tag = self._create_tag()
-        document = self._document_create()
-        tag.documents.add(document)
-
-        response = self.client.get(
-            reverse('rest_api:document-tag-detail', args=(document.pk, tag.pk))
+    def _request_document_attach_tag(self):
+        return self.post(
+            viewname='rest_api:document-tag-list', args=(self.document.pk,),
+            data={'tag_pk': self.tag.pk}
         )
 
-        self.assertEqual(response.data['label'], tag.label)
+    def test_document_attach_tag_view_no_access(self):
+        self.tag = self._create_tag()
+        self.document = self._document_create()
 
-    def test_document_tag_list_view(self):
-        tag = self._create_tag()
-        document = self._document_create()
-        tag.documents.add(document)
+        response = self._request_document_attach_tag()
+        self.assertEqual(response.status_code, status.HTTP_201_CREATED)
+        self.assertFalse(self.tag in self.document.tags.all())
 
-        response = self.client.get(
-            reverse('rest_api:document-tag-list', args=(document.pk,))
-        )
-        self.assertEqual(response.data['results'][0]['label'], tag.label)
+    def test_document_attach_tag_view_with_document_access(self):
+        self.tag = self._create_tag()
+        self.document = self._document_create()
+        self.grant_access(permission=permission_tag_attach, obj=self.document)
+        response = self._request_document_attach_tag()
+        self.assertEqual(response.status_code, status.HTTP_201_CREATED)
+        self.assertFalse(self.tag in self.document.tags.all())
 
-    def test_document_tag_remove_view(self):
-        tag = self._create_tag()
-        document = self._document_create()
-        tag.documents.add(document)
+    def test_document_attach_tag_view_with_tag_access(self):
+        self.tag = self._create_tag()
+        self.document = self._document_create()
+        self.grant_access(permission=permission_tag_attach, obj=self.tag)
+        response = self._request_document_attach_tag()
+        self.assertEqual(response.status_code, status.HTTP_201_CREATED)
+        self.assertFalse(self.tag in self.document.tags.all())
 
-        self.client.delete(
-            reverse(
-                'rest_api:document-tag-detail', args=(document.pk, tag.pk)
-            ),
+    def test_document_attach_tag_view_with_access(self):
+        self.tag = self._create_tag()
+        self.document = self._document_create()
+        self.grant_access(permission=permission_tag_attach, obj=self.document)
+        self.grant_access(permission=permission_tag_attach, obj=self.tag)
+        response = self._request_document_attach_tag()
+        self.assertEqual(response.status_code, status.HTTP_201_CREATED)
+        self.assertTrue(self.tag in self.document.tags.all())
+
+    def _request_document_tag_detail_view(self):
+        return self.get(
+            viewname='rest_api:document-tag-detail', args=(
+                self.document.pk, self.tag.pk
+            )
         )
 
-        self.assertEqual(tag.documents.count(), 0)
+    def test_document_tag_detail_view_no_access(self):
+        self.tag = self._create_tag()
+        self.document = self._document_create()
+        self.tag.documents.add(self.document)
+        response = self._request_document_tag_detail_view()
+        self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
+
+    def test_document_tag_detail_view_with_document_access(self):
+        self.tag = self._create_tag()
+        self.document = self._document_create()
+        self.tag.documents.add(self.document)
+        self.grant_access(permission=permission_document_view, obj=self.document)
+        response = self._request_document_tag_detail_view()
+        self.assertEqual(response.status_code, status.HTTP_404_NOT_FOUND)
+
+    def test_document_tag_detail_view_with_tag_access(self):
+        self.tag = self._create_tag()
+        self.document = self._document_create()
+        self.tag.documents.add(self.document)
+        self.grant_access(permission=permission_tag_view, obj=self.tag)
+        response = self._request_document_tag_detail_view()
+        self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
+
+    def test_document_tag_detail_view_with_access(self):
+        self.tag = self._create_tag()
+        self.document = self._document_create()
+        self.tag.documents.add(self.document)
+        self.grant_access(permission=permission_tag_view, obj=self.tag)
+        self.grant_access(permission=permission_document_view, obj=self.document)
+        response = self._request_document_tag_detail_view()
+        self.assertEqual(response.status_code, status.HTTP_200_OK)
+        self.assertEqual(response.data['label'], self.tag.label)
+
+    def _request_document_tag_list_view(self):
+        return self.get(
+            viewname='rest_api:document-tag-list', args=(self.document.pk,)
+        )
+
+    def test_document_tag_list_view_no_access(self):
+        self.tag = self._create_tag()
+        self.document = self._document_create()
+        self.tag.documents.add(self.document)
+        response = self._request_document_tag_list_view()
+        self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
+
+    def test_document_tag_list_view_with_document_access(self):
+        self.tag = self._create_tag()
+        self.document = self._document_create()
+        self.tag.documents.add(self.document)
+        self.grant_access(permission=permission_document_view, obj=self.document)
+        response = self._request_document_tag_list_view()
+        self.assertEqual(response.status_code, status.HTTP_200_OK)
+        self.assertEqual(response.data['count'], 0)
+
+    def test_document_tag_list_view_with_tag_access(self):
+        self.tag = self._create_tag()
+        self.document = self._document_create()
+        self.tag.documents.add(self.document)
+        self.grant_access(permission=permission_tag_view, obj=self.tag)
+        response = self._request_document_tag_list_view()
+        self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
+
+    def test_document_tag_list_view_with_access(self):
+        self.tag = self._create_tag()
+        self.document = self._document_create()
+        self.tag.documents.add(self.document)
+        self.grant_access(permission=permission_document_view, obj=self.document)
+        self.grant_access(permission=permission_tag_view, obj=self.tag)
+        response = self._request_document_tag_list_view()
+        self.assertEqual(response.status_code, status.HTTP_200_OK)
+        self.assertEqual(response.data['results'][0]['label'], self.tag.label)
+
+    def _request_document_tag_remove(self):
+        return self.delete(
+            viewname='rest_api:document-tag-detail', args=(
+                self.document.pk, self.tag.pk
+            )
+        )
+
+    def test_document_tag_remove_view_no_access(self):
+        self.tag = self._create_tag()
+        self.document = self._document_create()
+        self.tag.documents.add(self.document)
+        response = self._request_document_tag_remove()
+        self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
+        self.assertTrue(self.tag in self.document.tags.all())
+
+    def test_document_tag_remove_view_with_document_access(self):
+        self.tag = self._create_tag()
+        self.document = self._document_create()
+        self.tag.documents.add(self.document)
+        self.grant_access(permission=permission_tag_remove, obj=self.document)
+        response = self._request_document_tag_remove()
+        self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
+        self.assertTrue(self.tag in self.document.tags.all())
+
+    def test_document_tag_remove_view_with_tag_access(self):
+        self.tag = self._create_tag()
+        self.document = self._document_create()
+        self.tag.documents.add(self.document)
+        self.grant_access(permission=permission_tag_remove, obj=self.tag)
+        response = self._request_document_tag_remove()
+        self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
+        self.assertTrue(self.tag in self.document.tags.all())
+
+    def test_document_tag_remove_view_with_access(self):
+        self.tag = self._create_tag()
+        self.document = self._document_create()
+        self.tag.documents.add(self.document)
+        self.grant_access(permission=permission_document_view, obj=self.document)
+        self.grant_access(permission=permission_tag_remove, obj=self.tag)
+        response = self._request_document_tag_remove()
+        self.assertEqual(response.status_code, status.HTTP_204_NO_CONTENT)
+        self.assertFalse(self.tag in self.document.tags.all())