From a047d0e39de2b60cc377b15fa57c47ccc06316c2 Mon Sep 17 00:00:00 2001
From: stumpylog <797416+stumpylog@users.noreply.github.com>
Date: Fri, 31 Jul 2026 09:42:31 -0700
Subject: [PATCH] test: add version-only-grant case discriminating
 root-vs-version permission check

The former "stranger" sub-case in
test_permission_checked_on_root_not_on_version had zero grants on either
root or version, so it passed under any implementation, correct or
buggy. Replace it with a user granted view_document on the version
itself (not the root): this only passes if bulk_download truly checks
root-only, catching a regression to "root OR version" that the old
case could never detect.
---
 .../tests/test_permission_filtering_security.py  | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/src/documents/tests/test_permission_filtering_security.py b/src/documents/tests/test_permission_filtering_security.py
index ac8712c4a..f7a55f2f2 100644
--- a/src/documents/tests/test_permission_filtering_security.py
+++ b/src/documents/tests/test_permission_filtering_security.py
@@ -374,14 +374,24 @@ class TestBulkDownloadPermissionChecksRootDocument:
             response.status_code == HTTPStatus.OK
         )  # visible because root is permitted
 
-        stranger = User.objects.create_user(username="mallory")
-        rest_api_client.force_authenticate(user=stranger)
+        # Granted on the VERSION itself, but NOT on the root. If the endpoint
+        # ever regressed to checking "root OR version" instead of root-only,
+        # this grant would incorrectly unlock access. This is the case that
+        # actually discriminates correct (root-only) enforcement from a
+        # root-or-version bug; a user with no grant at all (the old
+        # `stranger` case) can't tell the two apart, since they're denied
+        # either way.
+        version_only_grantee = User.objects.create_user(username="version_only_grantee")
+        assign_perm("view_document", version_only_grantee, version)
+        rest_api_client.force_authenticate(user=version_only_grantee)
         response = rest_api_client.post(
             "/api/documents/bulk_download/",
             {"documents": [version.pk]},
             format="json",
         )
-        assert response.status_code == HTTPStatus.FORBIDDEN
+        assert (
+            response.status_code == HTTPStatus.FORBIDDEN
+        )  # version-only grant must not substitute for root permission
 
 
 @pytest.mark.django_db