From 0dbea9b6fe799baa21f85694f12c5c0c29b5a06f Mon Sep 17 00:00:00 2001 From: Fredrik Jonsson Date: Mon, 26 Oct 2026 19:20:22 +0100 Subject: [PATCH] Make can_view_submission check draft access permissions. --- hypha/apply/funds/permissions.py | 3 +++ hypha/apply/funds/tests/test_permissions.py | 26 +++++++++++++++++++++ hypha/apply/funds/tests/test_views.py | 14 ++++++++++- 3 files changed, 42 insertions(+), 1 deletion(-) diff --git a/hypha/apply/funds/permissions.py b/hypha/apply/funds/permissions.py index 09c6362058..7c566fd5e2 100644 --- a/hypha/apply/funds/permissions.py +++ b/hypha/apply/funds/permissions.py @@ -221,6 +221,9 @@ def can_view_submission(user, submission): if submission.is_archive and not can_view_archived_submissions(user): return False, _("Archived Submission") + if submission.is_draft and not submission.can_view_draft(user): + return False, _("Draft Submission") + if user.is_apply_staff or is_submission_applicant(user, submission): return True, "" diff --git a/hypha/apply/funds/tests/test_permissions.py b/hypha/apply/funds/tests/test_permissions.py index 666ed312ee..1f7d1808bb 100644 --- a/hypha/apply/funds/tests/test_permissions.py +++ b/hypha/apply/funds/tests/test_permissions.py @@ -270,6 +270,32 @@ def test_unrelated_user_cannot_view(self): result, _ = can_view_submission(user, submission) self.assertFalse(result) + def test_reviewer_cannot_view_draft(self): + reviewer = ReviewerFactory() + submission = ApplicationSubmissionFactory(status=DRAFT_STATE) + result, _ = can_view_submission(reviewer, submission) + self.assertFalse(result) + + def test_submission_owner_can_view_draft(self): + applicant = ApplicantFactory() + submission = ApplicationSubmissionFactory(user=applicant, status=DRAFT_STATE) + result, _ = can_view_submission(applicant, submission) + self.assertTrue(result) + + @override_settings(SUBMISSIONS_DRAFT_ACCESS_STAFF=False) + def test_staff_cannot_view_draft_when_setting_disabled(self): + staff = StaffFactory() + submission = ApplicationSubmissionFactory(status=DRAFT_STATE) + result, _ = can_view_submission(staff, submission) + self.assertFalse(result) + + @override_settings(SUBMISSIONS_DRAFT_ACCESS_STAFF=True) + def test_staff_can_view_draft_when_setting_enabled(self): + staff = StaffFactory() + submission = ApplicationSubmissionFactory(status=DRAFT_STATE) + result, _ = can_view_submission(staff, submission) + self.assertTrue(result) + @override_settings(SUBMISSIONS_ARCHIVED_VIEW_ACCESS_STAFF=False) def test_staff_cannot_view_archived_when_setting_disabled(self): staff = StaffFactory() diff --git a/hypha/apply/funds/tests/test_views.py b/hypha/apply/funds/tests/test_views.py index 0a9d155655..7d7db840c4 100644 --- a/hypha/apply/funds/tests/test_views.py +++ b/hypha/apply/funds/tests/test_views.py @@ -26,7 +26,7 @@ SealedSubmissionFactory, ) from hypha.apply.funds.views.submission_detail import SubmissionDetailView -from hypha.apply.funds.workflows import INITIAL_STATE +from hypha.apply.funds.workflows import DRAFT_STATE, INITIAL_STATE from hypha.apply.projects.models import Project from hypha.apply.projects.models.project import CONTRACTING from hypha.apply.projects.tests.factories import ProjectFactory @@ -979,6 +979,18 @@ def assert_create_review_displayed(submission, button_text): ReviewFactory(submission=submission, author__reviewer=self.user, is_draft=True) assert_create_review_displayed(submission, "Complete draft review") + def test_cant_see_draft_answers_partial(self): + self.reviewer_settings.use_settings = False + self.reviewer_settings.save() + submission = ApplicationSubmissionFactory( + status=DRAFT_STATE, user=self.applicant + ) + response = self.client.get( + reverse("apply:submissions:partial-answers", kwargs={"pk": submission.pk}), + secure=True, + ) + self.assertEqual(response.status_code, 403) + def test_cant_see_create_review_primary_action(self): def assert_create_review_not_displayed(submission, button_text): response = self.get_page(submission)