From 1e334903f33a000671028f2700283ab93a66e461 Mon Sep 17 00:00:00 2001
From: shamoon <4887959+shamoon@users.noreply.github.com>
Date: Tue, 20 Oct 2026 11:01:11 -0700
Subject: [PATCH] And test zone

---
 src/documents/tests/test_api_ocr_templates.py | 21 +++++++++++++++++++
 src/documents/views.py                        |  7 ++++++-
 2 files changed, 27 insertions(+), 1 deletion(-)

diff --git a/src/documents/tests/test_api_ocr_templates.py b/src/documents/tests/test_api_ocr_templates.py
index 452a2f320..754279250 100644
--- a/src/documents/tests/test_api_ocr_templates.py
+++ b/src/documents/tests/test_api_ocr_templates.py
@@ -455,6 +455,27 @@ class TestOcrTemplatesAPI(DirectoriesMixin, APITestCase):
         # Past the permission check; the factory document has no file on disk.
         self.assertEqual(response.status_code, status.HTTP_404_NOT_FOUND)
 
+    @patch("documents.zone_ocr.extract_zone_preview")
+    def test_test_zone_requires_view_permission_on_the_document(self, preview):
+        owner = User.objects.create_user(username="owner")
+        user = User.objects.create_user(username="template_editor")
+        user.user_permissions.add(Permission.objects.get(codename="add_ocrtemplate"))
+        document = DocumentFactory(owner=owner)
+        self.client.force_authenticate(user=user)
+        data = {
+            "document": document.pk,
+            "zone": {"x": 0, "y": 0, "width": 100, "height": 100, "page": 1},
+        }
+
+        response = self.client.post(f"{self.ENDPOINT}test-zone/", data, format="json")
+        self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
+
+        grant_object(user, document, "view_document")
+        response = self.client.post(f"{self.ENDPOINT}test-zone/", data, format="json")
+        # Past the permission check; the factory document has no file on disk.
+        self.assertEqual(response.status_code, status.HTTP_404_NOT_FOUND)
+        preview.assert_not_called()
+
     @patch("documents.zone_ocr.run_zone_extraction")
     def test_run_zone_ocr_requires_change_permission_on_the_document(
         self,
diff --git a/src/documents/views.py b/src/documents/views.py
index b619adac5..ee395879e 100644
--- a/src/documents/views.py
+++ b/src/documents/views.py
@@ -5937,13 +5937,18 @@ class OcrTemplateViewSet(ModelViewSet):
         zone_data = request.data.get("zone") or {}
 
         try:
-            document = Document.objects.get(pk=request.data.get("document"))
+            document = Document.objects.select_related(
+                "root_document__owner",
+            ).get(pk=request.data.get("document"))
         except (Document.DoesNotExist, ValueError, TypeError):
             return Response(
                 {"error": "Document not found"},
                 status=status.HTTP_404_NOT_FOUND,
             )
 
+        if not has_perms_owner_aware(request.user, "view_document", document):
+            return HttpResponseForbidden("Insufficient permissions")
+
         doc_path = document.archive_path or document.source_path
         if not doc_path or not Path(doc_path).is_file():
             return Response(