diff --git a/docs/usage.md b/docs/usage.md index 62ec15f73..c80a5a2d2 100644 --- a/docs/usage.md +++ b/docs/usage.md @@ -290,6 +290,16 @@ Consumption templates can assign: - Document owner - View and / or edit permissions to users or groups +### Consumption template permissions + +All users who have application permissions for editing consumption templates can see the same set +of templates. In other words, templates themselves intentionally do not have an owner or permissions. + +Given their potentially far-reaching capabilities, you may want to restrict access to templates. + +Upon migration, existing installs will grant access to consumption templates to users who can add +documents (and superusers who can always access all parts of the app). + ### Title placeholders Consumption template titles can include placeholders, _only for items that are assigned within the template_. diff --git a/src-ui/src/app/components/manage/consmption-templates-list/consmption-templates-list.component.html b/src-ui/src/app/components/manage/consmption-templates-list/consmption-templates-list.component.html index 472097460..098c2af41 100644 --- a/src-ui/src/app/components/manage/consmption-templates-list/consmption-templates-list.component.html +++ b/src-ui/src/app/components/manage/consmption-templates-list/consmption-templates-list.component.html @@ -11,22 +11,20 @@ Name + Sort order Document Sources - File name filter - Path filter Actions + {{template.order}} {{getSourceList(template)}} - {{template.filter_filename}} - {{template.filter_path}}
- - + +
diff --git a/src-ui/src/app/components/manage/consmption-templates-list/consmption-templates-list.component.ts b/src-ui/src/app/components/manage/consmption-templates-list/consmption-templates-list.component.ts index 3ff601fd6..2cbe37480 100644 --- a/src-ui/src/app/components/manage/consmption-templates-list/consmption-templates-list.component.ts +++ b/src-ui/src/app/components/manage/consmption-templates-list/consmption-templates-list.component.ts @@ -2,10 +2,7 @@ import { Component, OnInit } from '@angular/core' import { ConsumptionTemplateService } from 'src/app/services/rest/consumption-template.service' import { ComponentWithPermissions } from '../../with-permissions/with-permissions.component' import { Subject, takeUntil } from 'rxjs' -import { - DocumentSource, - PaperlessConsumptionTemplate, -} from 'src/app/data/paperless-consumption-template' +import { PaperlessConsumptionTemplate } from 'src/app/data/paperless-consumption-template' import { NgbModal } from '@ng-bootstrap/ng-bootstrap' import { ToastService } from 'src/app/services/toast.service' import { PermissionsService } from 'src/app/services/permissions.service' @@ -109,15 +106,4 @@ export class ConsmptionTemplatesListComponent }) }) } - - userCanEdit(template: PaperlessConsumptionTemplate): boolean { - return this.permissionsService.currentUserHasObjectPermissions( - this.PermissionAction.Change, - template - ) - } - - userIsOwner(template: PaperlessConsumptionTemplate): boolean { - return this.permissionsService.currentUserOwnsObject(template) - } } diff --git a/src-ui/src/app/data/paperless-consumption-template.ts b/src-ui/src/app/data/paperless-consumption-template.ts index 1052cfbe6..c303fc8d4 100644 --- a/src-ui/src/app/data/paperless-consumption-template.ts +++ b/src-ui/src/app/data/paperless-consumption-template.ts @@ -1,4 +1,4 @@ -import { ObjectWithPermissions } from './object-with-permissions' +import { ObjectWithId } from './object-with-id' export enum DocumentSource { ConsumeFolder = 1, @@ -6,7 +6,7 @@ export enum DocumentSource { MailFetch = 3, } -export interface PaperlessConsumptionTemplate extends ObjectWithPermissions { +export interface PaperlessConsumptionTemplate extends ObjectWithId { name: string order: number diff --git a/src/documents/migrations/1039_consumptiontemplate.py b/src/documents/migrations/1039_consumptiontemplate.py index 0ba0ac21c..cf8b9fd91 100644 --- a/src/documents/migrations/1039_consumptiontemplate.py +++ b/src/documents/migrations/1039_consumptiontemplate.py @@ -206,16 +206,6 @@ class Migration(migrations.Migration): verbose_name="grant view permissions to these users", ), ), - ( - "owner", - models.ForeignKey( - blank=True, - null=True, - on_delete=django.db.models.deletion.SET_NULL, - to=settings.AUTH_USER_MODEL, - verbose_name="owner", - ), - ), ], options={ "verbose_name": "consumption template", diff --git a/src/documents/models.py b/src/documents/models.py index 8f3c9a0de..a1f7d7dd6 100644 --- a/src/documents/models.py +++ b/src/documents/models.py @@ -740,16 +740,12 @@ class ShareLink(models.Model): return f"Share Link for {self.document.title}" -class ConsumptionTemplate(ModelWithOwner): +class ConsumptionTemplate(models.Model): class DocumentSourceChoices(models.IntegerChoices): CONSUME_FOLDER = DocumentSource.ConsumeFolder.value, _("Consume Folder") API_UPLOAD = DocumentSource.ApiUpload.value, _("Api Upload") MAIL_FETCH = DocumentSource.MailFetch.value, _("Mail Fetch") - class Meta: - verbose_name = _("consumption template") - verbose_name_plural = _("consumption templates") - name = models.CharField(_("name"), max_length=256, unique=True) order = models.IntegerField(_("order"), default=0) @@ -870,5 +866,9 @@ class ConsumptionTemplate(ModelWithOwner): verbose_name=_("grant change permissions to these groups"), ) + class Meta: + verbose_name = _("consumption template") + verbose_name_plural = _("consumption templates") + def __str__(self): return f"{self.name}" diff --git a/src/documents/serialisers.py b/src/documents/serialisers.py index ab957c1c9..00fc4b73b 100644 --- a/src/documents/serialisers.py +++ b/src/documents/serialisers.py @@ -1040,7 +1040,7 @@ class BulkEditObjectPermissionsSerializer(serializers.Serializer, SetPermissions return attrs -class ConsumptionTemplateSerializer(OwnedObjectSerializer): +class ConsumptionTemplateSerializer(serializers.ModelSerializer): order = serializers.IntegerField(required=False) sources = fields.MultipleChoiceField( choices=ConsumptionTemplate.DocumentSourceChoices.choices, @@ -1076,10 +1076,6 @@ class ConsumptionTemplateSerializer(OwnedObjectSerializer): "assign_view_groups", "assign_change_users", "assign_change_groups", - "owner", - "user_can_change", - "permissions", - "set_permissions", ] def validate(self, attrs): diff --git a/src/documents/views.py b/src/documents/views.py index 4a9080b53..3353a3272 100644 --- a/src/documents/views.py +++ b/src/documents/views.py @@ -1252,12 +1252,11 @@ class BulkEditObjectPermissionsView(GenericAPIView, PassUserMixin): ) -class ConsumptionTemplateViewSet(ModelViewSet, PassUserMixin): +class ConsumptionTemplateViewSet(ModelViewSet): permission_classes = (IsAuthenticated, PaperlessObjectPermissions) serializer_class = ConsumptionTemplateSerializer pagination_class = StandardPagination - filter_backends = (ObjectOwnedOrGrantedPermissionsFilter,) model = ConsumptionTemplate