Improve document comment app

Add keyword arguments to URL definitions and reverse resolution.
Raise HTTP error 404 instead of 403 to reduce the information
divulged. Add view tests.

Signed-off-by: Roberto Rosario <Roberto.Rosario@mayan-edms.com>

mayan/apps/document_comments/views.py

@@ -1,14 +1,13 @@
 from __future__ import absolute_import, unicode_literals
 
-from django.shortcuts import get_object_or_404
 from django.template import RequestContext
 from django.urls import reverse
 from django.utils.translation import ugettext_lazy as _
 
-from mayan.apps.acls.models import AccessControlList
 from mayan.apps.common.generics import (
     SingleObjectCreateView, SingleObjectDeleteView, SingleObjectListView
 )
+from mayan.apps.common.mixins import ExternalObjectViewMixin
 from mayan.apps.documents.models import Document
 
 from .icons import icon_comments_for_document
@@ -20,22 +19,15 @@ from .permissions import (
 )
 
 
-class DocumentCommentCreateView(SingleObjectCreateView):
+class DocumentCommentCreateView(ExternalObjectViewMixin, SingleObjectCreateView):
     fields = ('comment',)
+    external_object_pk_url_kwarg = 'document_pk'
+    external_object_class = Document
+    external_object_permission = permission_comment_create
     model = Comment
 
-    def dispatch(self, request, *args, **kwargs):
-        AccessControlList.objects.check_access(
-            permissions=permission_comment_create, user=request.user,
-            obj=self.get_document()
-        )
-
-        return super(
-            DocumentCommentCreateView, self
-        ).dispatch(request, *args, **kwargs)
-
     def get_document(self):
-        return get_object_or_404(klass=Document, pk=self.kwargs['pk'])
+        return self.get_external_object()
 
     def get_extra_context(self):
         return {
@@ -50,7 +42,9 @@ class DocumentCommentCreateView(SingleObjectCreateView):
 
     def get_post_action_redirect(self):
         return reverse(
-            'comments:comments_for_document', args=(self.kwargs['pk'],)
+            viewname='comments:comments_for_document', kwargs={
+                'document_pk': self.kwargs['document_pk']
+            }
         )
 
     def get_save_extra_data(self):
@@ -61,16 +55,9 @@ class DocumentCommentCreateView(SingleObjectCreateView):
 
 class DocumentCommentDeleteView(SingleObjectDeleteView):
     model = Comment
-
-    def dispatch(self, request, *args, **kwargs):
-        AccessControlList.objects.check_access(
-            permissions=permission_comment_delete, user=request.user,
-            obj=self.get_object().document
-        )
-
-        return super(
-            DocumentCommentDeleteView, self
-        ).dispatch(request, *args, **kwargs)
+    pk_url_kwarg = 'comment_pk'
+    object_permission = permission_comment_delete
+    object_permission_raise_404 = True
 
     def get_delete_extra_data(self):
         return {'_user': self.request.user}
@@ -83,36 +70,36 @@ class DocumentCommentDeleteView(SingleObjectDeleteView):
 
     def get_post_action_redirect(self):
         return reverse(
-            'comments:comments_for_document',
-            args=(self.get_object().document.pk,)
+            viewname='comments:comments_for_document', kwargs={
+                'document_pk': self.get_object().document.pk
+            }
         )
 
 
-class DocumentCommentListView(SingleObjectListView):
+class DocumentCommentListView(ExternalObjectViewMixin, SingleObjectListView):
+    external_object_pk_url_kwarg = 'document_pk'
+    external_object_class = Document
+    external_object_permission = permission_comment_view
+
     def get_document(self):
-        return get_object_or_404(klass=Document, pk=self.kwargs['pk'])
+        return self.get_external_object()
 
     def get_extra_context(self):
         return {
             'hide_link': True,
             'hide_object': True,
             'no_results_icon': icon_comments_for_document,
+            'no_results_external_link': link_comment_add.resolve(
+                RequestContext(self.request, {'object': self.get_document()})
+            ),
             'no_results_text': _(
                 'Document comments are timestamped text entries from users. '
                 'They are great for collaboration.'
             ),
-            'no_results_main_link': link_comment_add.resolve(
-                RequestContext(self.request, {'object': self.get_document()})
-            ),
             'no_results_title': _('There are no comments'),
             'object': self.get_document(),
             'title': _('Comments for document: %s') % self.get_document(),
         }
 
     def get_object_list(self):
-        AccessControlList.objects.check_access(
-            permissions=permission_comment_view, user=self.request.user,
-            obj=self.get_document()
-        )
-
         return self.get_document().comments.all()