Make can_view_submission check draft access permissions.

hypha/apply/funds/permissions.py

@@ -221,6 +221,9 @@ def can_view_submission(user, submission):
     if submission.is_archive and not can_view_archived_submissions(user):
         return False, _("Archived Submission")
 
+    if submission.is_draft and not submission.can_view_draft(user):
+        return False, _("Draft Submission")
+
     if user.is_apply_staff or is_submission_applicant(user, submission):
         return True, ""
 

hypha/apply/funds/tests/test_permissions.py

@@ -270,6 +270,32 @@ def test_unrelated_user_cannot_view(self):
         result, _ = can_view_submission(user, submission)
         self.assertFalse(result)
 
+    def test_reviewer_cannot_view_draft(self):
+        reviewer = ReviewerFactory()
+        submission = ApplicationSubmissionFactory(status=DRAFT_STATE)
+        result, _ = can_view_submission(reviewer, submission)
+        self.assertFalse(result)
+
+    def test_submission_owner_can_view_draft(self):
+        applicant = ApplicantFactory()
+        submission = ApplicationSubmissionFactory(user=applicant, status=DRAFT_STATE)
+        result, _ = can_view_submission(applicant, submission)
+        self.assertTrue(result)
+
+    @override_settings(SUBMISSIONS_DRAFT_ACCESS_STAFF=False)
+    def test_staff_cannot_view_draft_when_setting_disabled(self):
+        staff = StaffFactory()
+        submission = ApplicationSubmissionFactory(status=DRAFT_STATE)
+        result, _ = can_view_submission(staff, submission)
+        self.assertFalse(result)
+
+    @override_settings(SUBMISSIONS_DRAFT_ACCESS_STAFF=True)
+    def test_staff_can_view_draft_when_setting_enabled(self):
+        staff = StaffFactory()
+        submission = ApplicationSubmissionFactory(status=DRAFT_STATE)
+        result, _ = can_view_submission(staff, submission)
+        self.assertTrue(result)
+
     @override_settings(SUBMISSIONS_ARCHIVED_VIEW_ACCESS_STAFF=False)
     def test_staff_cannot_view_archived_when_setting_disabled(self):
         staff = StaffFactory()

hypha/apply/funds/tests/test_views.py

@@ -26,7 +26,7 @@
     SealedSubmissionFactory,
 )
 from hypha.apply.funds.views.submission_detail import SubmissionDetailView
-from hypha.apply.funds.workflows import INITIAL_STATE
+from hypha.apply.funds.workflows import DRAFT_STATE, INITIAL_STATE
 from hypha.apply.projects.models import Project
 from hypha.apply.projects.models.project import CONTRACTING
 from hypha.apply.projects.tests.factories import ProjectFactory
@@ -979,6 +979,18 @@ def assert_create_review_displayed(submission, button_text):
         ReviewFactory(submission=submission, author__reviewer=self.user, is_draft=True)
         assert_create_review_displayed(submission, "Complete draft review")
 
+    def test_cant_see_draft_answers_partial(self):
+        self.reviewer_settings.use_settings = False
+        self.reviewer_settings.save()
+        submission = ApplicationSubmissionFactory(
+            status=DRAFT_STATE, user=self.applicant
+        )
+        response = self.client.get(
+            reverse("apply:submissions:partial-answers", kwargs={"pk": submission.pk}),
+            secure=True,
+        )
+        self.assertEqual(response.status_code, 403)
+
     def test_cant_see_create_review_primary_action(self):
         def assert_create_review_not_displayed(submission, button_text):
             response = self.get_page(submission)