From 5c8c0db08f8dfdeed6a420c78fa0bece4e142019 Mon Sep 17 00:00:00 2001
From: shamoon <4887959+shamoon@users.noreply.github.com>
Date: Mon, 9 Nov 2026 08:43:34 -0800
Subject: [PATCH] preview should also require global view doc

---
 src/documents/tests/test_api_ocr_templates.py | 27 ++++++++++++++++---
 src/documents/views.py                        |  6 +++++
 2 files changed, 30 insertions(+), 3 deletions(-)

diff --git a/src/documents/tests/test_api_ocr_templates.py b/src/documents/tests/test_api_ocr_templates.py
index 748f3c6692..b58758c5a2 100644
--- a/src/documents/tests/test_api_ocr_templates.py
+++ b/src/documents/tests/test_api_ocr_templates.py
@@ -829,7 +829,7 @@ class TestOcrTemplatesAPI(DirectoriesMixin, APITestCase):
     def test_document_page_image_requires_view_permission_on_the_document(self):
         owner = User.objects.create_user(username="owner")
         user = User.objects.create_user(username="template_editor")
-        user.user_permissions.add(Permission.objects.get(codename="view_ocrtemplate"))
+        grant_global(user, "view_ocrtemplate", "view_document")
         document = DocumentFactory(owner=owner)
         self.client.force_authenticate(user=user)
         url = f"{self.ENDPOINT}document-page-image/{document.pk}/0/"
@@ -846,7 +846,7 @@ class TestOcrTemplatesAPI(DirectoriesMixin, APITestCase):
     def test_test_zone_requires_view_permission_on_the_document(self, preview):
         owner = User.objects.create_user(username="owner")
         user = User.objects.create_user(username="template_editor")
-        user.user_permissions.add(Permission.objects.get(codename="add_ocrtemplate"))
+        grant_global(user, "add_ocrtemplate", "view_document")
         document = DocumentFactory(owner=owner)
         self.client.force_authenticate(user=user)
         data = {
@@ -1184,7 +1184,7 @@ class TestOcrTemplatePreviewAPI(DirectoriesMixin, APITestCase):
     def setUp(self):
         super().setUp()
         self.user = User.objects.create_user(username="template_editor")
-        grant_global(self.user, "view_ocrtemplate", "add_ocrtemplate")
+        grant_global(self.user, "view_ocrtemplate", "add_ocrtemplate", "view_document")
         self.client.force_authenticate(self.user)
         self.document = DocumentFactory(
             owner=self.user,
@@ -1207,6 +1207,27 @@ class TestOcrTemplatePreviewAPI(DirectoriesMixin, APITestCase):
             format="json",
         )
 
+    @patch("documents.zone_ocr.extract_zone_preview")
+    def test_previews_require_global_document_view_permission(self, extract):
+        user = User.objects.create_user(username="template_only")
+        grant_global(user, "view_ocrtemplate", "add_ocrtemplate")
+        self.client.force_authenticate(user)
+        document = DocumentFactory(owner=None, mime_type="image/png")
+        document.source_path.write_bytes(b"document contents")
+        extract.return_value = {"raw_text": "document contents", "value": None}
+
+        with self.subTest(action="document-page-image"):
+            response = self.client.get(self.preview_url(document))
+            self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
+        with self.subTest(action="test-zone"):
+            response = self.client.post(
+                "/api/ocr_templates/test-zone/",
+                {"document": document.pk, "zone": {"width": 100, "height": 50}},
+                format="json",
+            )
+            self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
+        extract.assert_not_called()
+
     def test_missing_document_and_out_of_range_pages(self):
         response = self.client.get("/api/ocr_templates/document-page-image/99999/0/")
         self.assertEqual(response.status_code, 404)
diff --git a/src/documents/views.py b/src/documents/views.py
index e516a8cd09..df1947978e 100644
--- a/src/documents/views.py
+++ b/src/documents/views.py
@@ -5847,6 +5847,12 @@ class OcrTemplateViewSet(BulkPermissionMixin, PassUserMixin, ModelViewSet[OcrTem
     )
     ordering_fields = ("name",)
 
+    def get_permissions(self):
+        permissions = super().get_permissions()
+        if self.action in {"document_page_image", "test_zone"}:
+            permissions.append(ViewDocumentsPermissions())
+        return permissions
+
     @action(
         detail=False,
         methods=["get"],