diff --git a/docs/releases/2.8.rst b/docs/releases/2.8.rst index 1bdf3fc98a..70cef1c2fa 100644 --- a/docs/releases/2.8.rst +++ b/docs/releases/2.8.rst @@ -28,7 +28,6 @@ What's new - Add view to show list of events performed by an user. - Allow filtering an event list by clicking on the user column. - Revise and improve permission requirements for the documents app API. - - Downloading a document version now requires the document download permission instead of just the document view permission. - Creating a new document no longer works by having the document create permission in a global manner. It is now possible to create a document via the API by having the document permission for a specific document type. diff --git a/mayan/apps/documents/tests/test_api.py b/mayan/apps/documents/tests/test_api.py index 6e44cfc01d..87910573ca 100644 --- a/mayan/apps/documents/tests/test_api.py +++ b/mayan/apps/documents/tests/test_api.py @@ -66,6 +66,13 @@ class DocumentTypeAPITestCase(BaseAPITestCase): ), data={'label': TEST_DOCUMENT_TYPE_LABEL_EDITED} ) + def test_document_type_edit_via_patch_no_permission(self): + self.document_type = DocumentType.objects.create( + label=TEST_DOCUMENT_TYPE_LABEL + ) + response = self._request_document_type_patch() + self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN) + def test_document_type_edit_via_patch_with_access(self): self.document_type = DocumentType.objects.create( label=TEST_DOCUMENT_TYPE_LABEL @@ -73,18 +80,14 @@ class DocumentTypeAPITestCase(BaseAPITestCase): self.grant_access( permission=permission_document_type_edit, obj=self.document_type ) + response = self._request_document_type_put() + self.assertEqual(response.status_code, status.HTTP_200_OK) + self.document_type.refresh_from_db() self.assertEqual( self.document_type.label, TEST_DOCUMENT_TYPE_LABEL_EDITED ) - def test_document_type_edit_via_patch_no_permission(self): - self.document_type = DocumentType.objects.create( - label=TEST_DOCUMENT_TYPE_LABEL - ) - response = self._request_document_type_patch() - self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN) - def _request_document_type_put(self): return self.put( viewname='rest_api:documenttype-detail', args=( @@ -276,6 +279,7 @@ class DocumentAPITestCase(BaseAPITestCase): ) response = self._request_document_version_revert() self.assertEqual(response.status_code, status.HTTP_204_NO_CONTENT) + self.assertEqual(self.document.versions.count(), 1) self.assertEqual( self.document.versions.first(), self.document.latest_version