And test zone

src/documents/tests/test_api_ocr_templates.py

@@ -455,6 +455,27 @@ class TestOcrTemplatesAPI(DirectoriesMixin, APITestCase):
         # Past the permission check; the factory document has no file on disk.
         self.assertEqual(response.status_code, status.HTTP_404_NOT_FOUND)
 
+    @patch("documents.zone_ocr.extract_zone_preview")
+    def test_test_zone_requires_view_permission_on_the_document(self, preview):
+        owner = User.objects.create_user(username="owner")
+        user = User.objects.create_user(username="template_editor")
+        user.user_permissions.add(Permission.objects.get(codename="add_ocrtemplate"))
+        document = DocumentFactory(owner=owner)
+        self.client.force_authenticate(user=user)
+        data = {
+            "document": document.pk,
+            "zone": {"x": 0, "y": 0, "width": 100, "height": 100, "page": 1},
+        }
+
+        response = self.client.post(f"{self.ENDPOINT}test-zone/", data, format="json")
+        self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
+
+        grant_object(user, document, "view_document")
+        response = self.client.post(f"{self.ENDPOINT}test-zone/", data, format="json")
+        # Past the permission check; the factory document has no file on disk.
+        self.assertEqual(response.status_code, status.HTTP_404_NOT_FOUND)
+        preview.assert_not_called()
+
     @patch("documents.zone_ocr.run_zone_extraction")
     def test_run_zone_ocr_requires_change_permission_on_the_document(
         self,

src/documents/views.py

@@ -5937,13 +5937,18 @@ class OcrTemplateViewSet(ModelViewSet):
         zone_data = request.data.get("zone") or {}
 
         try:
-            document = Document.objects.get(pk=request.data.get("document"))
+            document = Document.objects.select_related(
+                "root_document__owner",
+            ).get(pk=request.data.get("document"))
         except (Document.DoesNotExist, ValueError, TypeError):
             return Response(
                 {"error": "Document not found"},
                 status=status.HTTP_404_NOT_FOUND,
             )
 
+        if not has_perms_owner_aware(request.user, "view_document", document):
+            return HttpResponseForbidden("Insufficient permissions")
+
         doc_path = document.archive_path or document.source_path
         if not doc_path or not Path(doc_path).is_file():
             return Response(