From 8100a8e1eb47d75e09ac7ed2517a784a0dbc7dea Mon Sep 17 00:00:00 2001
From: shamoon <4887959+shamoon@users.noreply.github.com>
Date: Tue, 20 Oct 2026 11:04:17 -0700
Subject: [PATCH] Lol and run zone ocr

---
 src/documents/tests/test_api_ocr_templates.py | 14 ++++++++++++++
 src/documents/views.py                        |  8 ++++++--
 2 files changed, 20 insertions(+), 2 deletions(-)

diff --git a/src/documents/tests/test_api_ocr_templates.py b/src/documents/tests/test_api_ocr_templates.py
index 754279250..ec41bb6b8 100644
--- a/src/documents/tests/test_api_ocr_templates.py
+++ b/src/documents/tests/test_api_ocr_templates.py
@@ -496,6 +496,20 @@ class TestOcrTemplatesAPI(DirectoriesMixin, APITestCase):
         self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
         extract.assert_not_called()
 
+    @patch("documents.zone_ocr.run_zone_extraction")
+    def test_run_zone_ocr_requires_global_change_permission(self, extract):
+        user = User.objects.create_user(username="uploader")
+        user.user_permissions.add(
+            *Permission.objects.filter(codename__in=["view_document", "add_document"]),
+        )
+        document = DocumentFactory(document_type=self.doc_type, owner=user)
+        self.client.force_authenticate(user=user)
+
+        response = self.client.post(f"/api/documents/{document.pk}/run-zone-ocr/")
+
+        self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
+        extract.assert_not_called()
+
     def test_run_zone_ocr_missing_document_is_an_error(self):
         response = self.client.post("/api/documents/99999/run-zone-ocr/")
 
diff --git a/src/documents/views.py b/src/documents/views.py
index ee395879e..69d9616c9 100644
--- a/src/documents/views.py
+++ b/src/documents/views.py
@@ -2296,10 +2296,14 @@ class DocumentViewSet(
     def run_zone_ocr(self, request, pk=None):
         """Run zone-based OCR extraction on this document."""
         try:
-            document = Document.objects.get(pk=pk)
+            document = Document.objects.select_related(
+                "root_document__owner",
+            ).get(pk=pk)
         except Document.DoesNotExist:
             raise Http404
-        if not has_perms_owner_aware(request.user, "change_document", document):
+        if not request.user.has_perm(
+            "documents.change_document",
+        ) or not has_perms_owner_aware(request.user, "change_document", document):
             return HttpResponseForbidden("Insufficient permissions")
 
         if not document.document_type_id: