From 449fd97b1f052c333470a7ae47896d702d59e04b Mon Sep 17 00:00:00 2001
From: shamoon <4887959+shamoon@users.noreply.github.com>
Date: Fri, 5 Jun 2026 07:16:53 -0700
Subject: [PATCH] Fix (beta): respect disable state for suggest endpoint,
 require change perms (#12942)

---
 .../suggestions-dropdown.component.html              |  4 ++--
 .../suggestions-dropdown.component.spec.ts           | 12 ++++++++++++
 .../suggestions-dropdown.component.ts                |  8 ++++++++
 src/documents/views.py                               |  4 ++--
 4 files changed, 24 insertions(+), 4 deletions(-)

diff --git a/src-ui/src/app/components/common/suggestions-dropdown/suggestions-dropdown.component.html b/src-ui/src/app/components/common/suggestions-dropdown/suggestions-dropdown.component.html
index 7e1a29666..8fb900eaa 100644
--- a/src-ui/src/app/components/common/suggestions-dropdown/suggestions-dropdown.component.html
+++ b/src-ui/src/app/components/common/suggestions-dropdown/suggestions-dropdown.component.html
@@ -1,5 +1,5 @@
 <div class="btn-group">
-  <button type="button" class="btn btn-sm btn-outline-primary" (click)="clickSuggest()" [disabled]="loading || (suggestions && !aiEnabled)">
+  <button type="button" class="btn btn-sm btn-outline-primary" (click)="clickSuggest()" [disabled]="disabled || loading || (suggestions && !aiEnabled)">
     @if (loading) {
       <div class="spinner-border spinner-border-sm" role="status"></div>
     } @else {
@@ -13,7 +13,7 @@
 
   @if (aiEnabled) {
     <div class="btn-group" ngbDropdown #dropdown="ngbDropdown" [popperOptions]="popperOptions">
-      <button type="button" class="btn btn-sm btn-outline-primary" ngbDropdownToggle [disabled]="loading || !suggestions" aria-expanded="false" aria-controls="suggestionsDropdown" aria-label="Suggestions dropdown">
+      <button type="button" class="btn btn-sm btn-outline-primary" ngbDropdownToggle [disabled]="disabled || loading || !suggestions" aria-expanded="false" aria-controls="suggestionsDropdown" aria-label="Suggestions dropdown">
         <span class="visually-hidden" i18n>Show suggestions</span>
       </button>
 
diff --git a/src-ui/src/app/components/common/suggestions-dropdown/suggestions-dropdown.component.spec.ts b/src-ui/src/app/components/common/suggestions-dropdown/suggestions-dropdown.component.spec.ts
index 801a56af3..863393ace 100644
--- a/src-ui/src/app/components/common/suggestions-dropdown/suggestions-dropdown.component.spec.ts
+++ b/src-ui/src/app/components/common/suggestions-dropdown/suggestions-dropdown.component.spec.ts
@@ -37,6 +37,18 @@ describe('SuggestionsDropdownComponent', () => {
     expect(component.getSuggestions.emit).toHaveBeenCalled()
   })
 
+  it('should not emit getSuggestions when disabled', () => {
+    jest.spyOn(component.getSuggestions, 'emit')
+    component.disabled = true
+    component.suggestions = null
+    fixture.detectChanges()
+
+    component.clickSuggest()
+
+    expect(component.getSuggestions.emit).not.toHaveBeenCalled()
+    expect(fixture.nativeElement.querySelector('button').disabled).toBeTruthy()
+  })
+
   it('should toggle dropdown when clickSuggest is called and suggestions are not null', () => {
     component.aiEnabled = true
     fixture.detectChanges()
diff --git a/src-ui/src/app/components/common/suggestions-dropdown/suggestions-dropdown.component.ts b/src-ui/src/app/components/common/suggestions-dropdown/suggestions-dropdown.component.ts
index b165f0a5e..6cf63f683 100644
--- a/src-ui/src/app/components/common/suggestions-dropdown/suggestions-dropdown.component.ts
+++ b/src-ui/src/app/components/common/suggestions-dropdown/suggestions-dropdown.component.ts
@@ -47,6 +47,14 @@ export class SuggestionsDropdownComponent {
   addCorrespondent: EventEmitter<string> = new EventEmitter()
 
   public clickSuggest(): void {
+    if (
+      this.disabled ||
+      this.loading ||
+      (this.suggestions && !this.aiEnabled)
+    ) {
+      return
+    }
+
     if (!this.suggestions) {
       this.getSuggestions.emit(this)
     } else {
diff --git a/src/documents/views.py b/src/documents/views.py
index 511429129..4fc0b3f51 100644
--- a/src/documents/views.py
+++ b/src/documents/views.py
@@ -1400,7 +1400,7 @@ class DocumentViewSet(
         )
         if request.user is not None and not has_perms_owner_aware(
             request.user,
-            "view_document",
+            "change_document",
             doc,
         ):
             return HttpResponseForbidden("Insufficient permissions")
@@ -1460,7 +1460,7 @@ class DocumentViewSet(
         )
         if request.user is not None and not has_perms_owner_aware(
             request.user,
-            "view_document",
+            "change_document",
             doc,
         ):
             return HttpResponseForbidden("Insufficient permissions")