Include permissions for mail rules & accounts

src/paperless_mail/tests/test_api.py

@@ -1,7 +1,9 @@
 import json
 from unittest import mock
 
+from django.contrib.auth.models import Permission
 from django.contrib.auth.models import User
+from guardian.shortcuts import assign_perm
 from rest_framework import status
 from rest_framework.test import APITestCase
 
@@ -27,7 +29,9 @@ class TestAPIMailAccounts(DirectoriesMixin, APITestCase):
 
         super().setUp()
 
-        self.user = User.objects.create_superuser(username="temp_admin")
+        self.user = User.objects.create_user(username="temp_admin")
+        self.user.user_permissions.add(*Permission.objects.all())
+        self.user.save()
         self.client.force_authenticate(user=self.user)
 
     def test_get_mail_accounts(self):
@@ -266,6 +270,73 @@ class TestAPIMailAccounts(DirectoriesMixin, APITestCase):
         self.assertEqual(response.status_code, status.HTTP_200_OK)
         self.assertEqual(response.data["success"], True)
 
+    def test_get_mail_accounts_owner_aware(self):
+        """
+        GIVEN:
+            - Configured accounts with different users
+        WHEN:
+            - API call is made to get mail accounts
+        THEN:
+            - Only unowned, owned by user or granted accounts are provided
+        """
+
+        user2 = User.objects.create_user(username="temp_admin2")
+
+        account1 = MailAccount.objects.create(
+            name="Email1",
+            username="username1",
+            password="password1",
+            imap_server="server.example.com",
+            imap_port=443,
+            imap_security=MailAccount.ImapSecurity.SSL,
+            character_set="UTF-8",
+        )
+
+        account2 = MailAccount.objects.create(
+            name="Email2",
+            username="username2",
+            password="password2",
+            imap_server="server.example.com",
+            imap_port=443,
+            imap_security=MailAccount.ImapSecurity.SSL,
+            character_set="UTF-8",
+        )
+        account2.owner = self.user
+        account2.save()
+
+        account3 = MailAccount.objects.create(
+            name="Email3",
+            username="username3",
+            password="password3",
+            imap_server="server.example.com",
+            imap_port=443,
+            imap_security=MailAccount.ImapSecurity.SSL,
+            character_set="UTF-8",
+        )
+        account3.owner = user2
+        account3.save()
+
+        account4 = MailAccount.objects.create(
+            name="Email4",
+            username="username4",
+            password="password4",
+            imap_server="server.example.com",
+            imap_port=443,
+            imap_security=MailAccount.ImapSecurity.SSL,
+            character_set="UTF-8",
+        )
+        account4.owner = user2
+        account4.save()
+        assign_perm("view_mailaccount", self.user, account4)
+
+        response = self.client.get(self.ENDPOINT)
+
+        self.assertEqual(response.status_code, status.HTTP_200_OK)
+        self.assertEqual(response.data["count"], 3)
+        self.assertEqual(response.data["results"][0]["name"], account1.name)
+        self.assertEqual(response.data["results"][1]["name"], account2.name)
+        self.assertEqual(response.data["results"][2]["name"], account4.name)
+
 
 class TestAPIMailRules(DirectoriesMixin, APITestCase):
     ENDPOINT = "/api/mail_rules/"
@@ -273,7 +344,9 @@ class TestAPIMailRules(DirectoriesMixin, APITestCase):
     def setUp(self):
         super().setUp()
 
-        self.user = User.objects.create_superuser(username="temp_admin")
+        self.user = User.objects.create_user(username="temp_admin")
+        self.user.user_permissions.add(*Permission.objects.all())
+        self.user.save()
         self.client.force_authenticate(user=self.user)
 
     def test_get_mail_rules(self):
@@ -533,3 +606,72 @@ class TestAPIMailRules(DirectoriesMixin, APITestCase):
         returned_rule1 = MailRule.objects.get(pk=rule1.pk)
         self.assertEqual(returned_rule1.name, "Updated Name 1")
         self.assertEqual(returned_rule1.action, MailRule.MailAction.DELETE)
+
+    def test_get_mail_rules_owner_aware(self):
+        """
+        GIVEN:
+            - Configured rules with different users
+        WHEN:
+            - API call is made to get mail rules
+        THEN:
+            - Only unowned, owned by user or granted mail rules are provided
+        """
+
+        user2 = User.objects.create_user(username="temp_admin2")
+
+        account1 = MailAccount.objects.create(
+            name="Email1",
+            username="username1",
+            password="password1",
+            imap_server="server.example.com",
+            imap_port=443,
+            imap_security=MailAccount.ImapSecurity.SSL,
+            character_set="UTF-8",
+        )
+
+        rule1 = MailRule.objects.create(
+            name="Rule1",
+            account=account1,
+            folder="INBOX",
+            filter_from="from@example1.com",
+            order=0,
+        )
+
+        rule2 = MailRule.objects.create(
+            name="Rule2",
+            account=account1,
+            folder="INBOX",
+            filter_from="from@example2.com",
+            order=1,
+        )
+        rule2.owner = self.user
+        rule2.save()
+
+        rule3 = MailRule.objects.create(
+            name="Rule3",
+            account=account1,
+            folder="INBOX",
+            filter_from="from@example3.com",
+            order=2,
+        )
+        rule3.owner = user2
+        rule3.save()
+
+        rule4 = MailRule.objects.create(
+            name="Rule4",
+            account=account1,
+            folder="INBOX",
+            filter_from="from@example4.com",
+            order=3,
+        )
+        rule4.owner = user2
+        rule4.save()
+        assign_perm("view_mailrule", self.user, rule4)
+
+        response = self.client.get(self.ENDPOINT)
+
+        self.assertEqual(response.status_code, status.HTTP_200_OK)
+        self.assertEqual(response.data["count"], 3)
+        self.assertEqual(response.data["results"][0]["name"], rule1.name)
+        self.assertEqual(response.data["results"][1]["name"], rule2.name)
+        self.assertEqual(response.data["results"][2]["name"], rule4.name)