From c043bf168d6b039e0e4362748fcf0d920fed3f85 Mon Sep 17 00:00:00 2001
From: stumpylog <797416+stumpylog@users.noreply.github.com>
Date: Fri, 31 Jul 2026 09:37:26 -0700
Subject: [PATCH] test: repurpose inert grant into mixed-batch bulk-edit
 rejection case

The unrelated view_document grant in
test_bulk_edit_rejects_document_without_change_permission created a
document that was never referenced in the request payload. Turn it
into a genuinely useful case instead: a mixed batch containing one
document the requester is fully permitted to change alongside one
they are not, proving bulk_edit rejects the whole batch when any
document lacks change permission (not just checking the first/last
document in the list).
---
 .../tests/test_permission_filtering_security.py | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/src/documents/tests/test_permission_filtering_security.py b/src/documents/tests/test_permission_filtering_security.py
index 8ed390be1..ac8712c4a 100644
--- a/src/documents/tests/test_permission_filtering_security.py
+++ b/src/documents/tests/test_permission_filtering_security.py
@@ -313,10 +313,15 @@ class TestEmailDocumentPermissionBoundary:
 
 @pytest.mark.django_db
 class TestBulkEditChangePermissionBoundary:
-    def test_bulk_edit_rejects_document_without_change_permission(
+    def test_bulk_edit_rejects_mixed_batch_when_any_document_lacks_change_permission(
         self,
         rest_api_client,
     ):
+        # A bulk-edit request containing both a document the requester CAN
+        # change and one they CANNOT should be rejected as a whole: the
+        # permitted document must not be partially applied just because it
+        # was bundled with a forbidden one, proving the endpoint checks
+        # every document in the batch rather than only the first/last.
         owner = User.objects.create_user(username="owner")
         requester = User.objects.create_user(username="requester")
         # grant the global change_document permission so the object-level
@@ -325,18 +330,16 @@ class TestBulkEditChangePermissionBoundary:
             Permission.objects.get(codename="change_document"),
         )
         rest_api_client.force_authenticate(user=requester)
-        assign_perm(
-            "view_document",
-            requester,
-            DocumentFactory(owner=owner),
-        )  # unrelated grant
+        changeable = DocumentFactory(owner=owner)
+        assign_perm("view_document", requester, changeable)
+        assign_perm("change_document", requester, changeable)  # fully permitted
         target = DocumentFactory(owner=owner)
         assign_perm("view_document", requester, target)  # view only, NOT change
 
         response = rest_api_client.post(
             "/api/documents/bulk_edit/",
             {
-                "documents": [target.pk],
+                "documents": [changeable.pk, target.pk],
                 "method": "modify_tags",
                 "parameters": {"add_tags": [], "remove_tags": []},
             },