Add testcases

apps/entry/models.py

@@ -25,7 +25,7 @@
     Exportable,
 )
 from assisted_tagging.models import DraftEntry
-from gallery.enums import ModuleTypeEnum
+from gallery.enums import PrivateFileModuleType
 
 
 class EntryAttachment(models.Model):
@@ -78,7 +78,7 @@ def get_file_url(self):
             url=reverse(
                 'external_private_url',
                 kwargs={
-                    'module': ModuleTypeEnum.ENTRY_ATTACHMENT.value,
+                    'module': PrivateFileModuleType.ENTRY_ATTACHMENT.value,
                     'identifier': urlsafe_base64_encode(force_bytes(self.id))
                 }
             )

apps/entry/schema.py

@@ -86,7 +86,7 @@ def resolve_geo_selected_options(root, info, **_):
 
 
 class EntryAttachmentType(DjangoObjectType):
-    lead_attachment_id = graphene.ID(required=True)
+    lead_attachment_id = graphene.ID(required=False)
     file = graphene.Field(FileFieldType, required=True)
     file_preview = graphene.Field(FileFieldType, required=True)
     entry_file_type = graphene.Field(EntryAttachmentTypeEnum, required=True)

apps/export/entries/excel_exporter.py

@@ -15,6 +15,8 @@
 from lead.models import Lead
 from export.models import Export
 
+from gallery.utils import get_private_file_url
+from gallery.enums import PrivateFileModuleType
 logger = logging.getLogger(__name__)
 
 
@@ -273,7 +275,7 @@ def add_entries_from_excel_data_for_static_column(
                 return [entry_excerpt, entry.dropped_excerpt]
             return entry_excerpt
         elif exportable == Export.StaticColumn.LEAD_ENTRY_ENTRY_ATTACHMENT_FILE_PREVIEW:
-            return f'{entry.entry_attachment.get_file_url()}'
+            return get_private_file_url(PrivateFileModuleType.ENTRY_ATTACHMENT.value, entry.entry_attachment.id)
 
     def add_entries_from_excel_data(self, rows, data, export_data):
         export_type = data.get('type')

apps/gallery/enums.py

@@ -1,6 +1,6 @@
 import graphene
 
 
-class ModuleTypeEnum(graphene.Enum):
+class PrivateFileModuleType(graphene.Enum):
     ENTRY_ATTACHMENT = 'entry-attachment'
     LEAD_PREVIEW_ATTACHMENT = 'lead-preview-attachment'

apps/gallery/tests/test_apis.py

@@ -6,11 +6,15 @@
 from django.utils.http import urlsafe_base64_encode
 from django.utils.encoding import force_bytes
 
+from rest_framework import status
+
 from deep.tests import TestCase
 from gallery.models import File, FilePreview
 from lead.models import Lead
 from project.models import Project
-from entry.models import Entry
+from entry.models import Entry, EntryAttachment
+from user.models import User
+from gallery.enums import PrivateFileModuleType
 
 
 class GalleryTests(TestCase):
@@ -205,3 +209,38 @@ def save_file_with_api(self, kwargs={}):
         return response.data['id']
 
     # NOTE: Test for files
+
+
+class PrivateAttachmentFileViewTest(TestCase):
+    def setUp(self):
+        # Create a test user
+        self.user = User.objects.create_user(username='testuser', password='testpassword')
+
+        # Create a test entry attachment
+        self.project = Project.objects.create()
+        self.lead = Lead.objects.create(project=Project)
+        self.attachment = EntryAttachment.objects.create()
+        self.entry = Entry.objects.create(
+            lead=self.lead,
+            project=self.project,
+            entry=self.attachment
+        )
+        self.url = reverse('private_attachment_file_view', kwargs={
+            'module': PrivateFileModuleType.ENTRY_ATTACHMENT.value,
+            'identifier': urlsafe_base64_encode(force_bytes(self.attachment.id)),
+        })
+
+    def test_access_by_authenticated_user(self):
+        self.authenticate()
+        response = self.client.get(self.url)
+        self.assert_200(response)
+
+    def test_access_forbidden(self):
+        self.authenticate()
+        invalid_url = reverse('private_attachment_file_view', kwargs={
+            'module': PrivateFileModuleType.ENTRY_ATTACHMENT.value,
+            'identifier': urlsafe_base64_encode(force_bytes(999999)),
+        })
+        response = self.client.get(invalid_url)
+        self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
+        self.assertEqual(response.data['error'], "Access Forbidden Or File doesn't exists, Contact Admin")

apps/gallery/utils.py

@@ -0,0 +1,20 @@
+from django.conf import settings
+from django.urls import reverse
+from django.utils.encoding import force_bytes
+from django.utils.http import urlsafe_base64_encode
+
+from gallery.enums import PrivateFileModuleType
+
+
+def get_private_file_url(obj, id):
+    return '{protocol}://{domain}{url}'.format(
+        protocol=settings.HTTP_PROTOCOL,
+        domain=settings.DJANGO_API_HOST,
+        url=reverse(
+            'external_private_url',
+            kwargs={
+                'module': obj,
+                'identifier': urlsafe_base64_encode(force_bytes(id))
+            }
+        )
+    )

apps/gallery/views.py

@@ -7,7 +7,7 @@
 from django.utils.http import urlsafe_base64_decode
 from django.shortcuts import redirect, get_object_or_404
 
-from gallery.enums import ModuleTypeEnum
+from gallery.enums import PrivateFileModuleType 
 from rest_framework import (
     views,
     viewsets,
@@ -83,21 +83,20 @@ def get(self, request, uuid=None, filename=None):
         )
 
 
-class AttachmentFileView(views.APIView):
+class PrivateAttachmentFileView(views.APIView):
     permission_classes = [permissions.IsAuthenticated]
 
     def get(self, request, module=None, identifier=None):
-
-        if module == ModuleTypeEnum.ENTRY_ATTACHMENT.value:
-            id = force_text(urlsafe_base64_decode(identifier))
-            qs = get_object_or_404(EntryAttachment, id=id)
-            if qs:
-                return redirect(request.build_absolute_uri(qs.file.url))
-            return response.Response({
-                'error': 'File doesn\'t exists',
-            }, status=status.HTTP_404_NOT_FOUND)
+        id = force_text(urlsafe_base64_decode(identifier))
+        user = request.user
+        obj = None
+        if module == PrivateFileModuleType.ENTRY_ATTACHMENT.value:
+            obj = get_object_or_404(EntryAttachment, id=id)
+            obj.entry.get_for(user)
+        if obj:
+            return redirect(request.build_absolute_uri(obj.file.url))
         return response.Response({
-            'error': 'Access Forbidden, Contact Admin',
+            'error': 'Access Forbidden Or File does\'t exists, Contact Admin',
         }, status=status.HTTP_403_FORBIDDEN)
 
 

apps/lead/migrations/0051_auto_20240625_0509.py

@@ -7,7 +7,7 @@ def set_file_preview(apps, schema_editor):
     LeadPreviewAttachment = apps.get_model('lead', 'LeadPreviewAttachment')
     LeadPreviewAttachment.objects.update(
         file_preview=models.F('file'),
-        type=2,
+        type=2,  # default type is Image
     )
 
 

apps/lead/schema.py

@@ -61,6 +61,15 @@ def get_lead_qs(info):
     return Lead.objects.none()
 
 
+def get_lead_preview_attachment(info):
+    lead_attachment_qs = LeadPreviewAttachment.objects.filter(
+        lead__project=info.context.active_project
+    ).order_by('-page_number')
+    if PP.check_permission(info, PP.Permission.VIEW_ALL_LEAD):
+        return lead_attachment_qs
+    return LeadPreviewAttachment.objects.none()
+
+
 def get_lead_group_qs(info):
     lead_group_qs = LeadGroup.objects.filter(project=info.context.active_project)
     if PP.check_permission(info, PP.Permission.VIEW_ALL_LEAD):
@@ -232,6 +241,10 @@ class Meta:
             'page_number',
         )
 
+    @staticmethod
+    def get_custom_queryset(queryset, info, **kwargs):
+        return get_lead_preview_attachment(info)
+
 
 class LeadEmmTriggerType(DjangoObjectType):
     class Meta:
@@ -523,6 +536,10 @@ class Query:
     def resolve_leads(root, info, **kwargs) -> QuerySet:
         return get_lead_qs(info)
 
+    @staticmethod
+    def resolve_lead_preview_attachments(root, info, **kwargs) -> QuerySet:
+        return get_lead_preview_attachment(info)
+
     @staticmethod
     def resolve_lead_groups(root, info, **kwargs) -> QuerySet:
         return get_lead_group_qs(info)

apps/unified_connector/migrations/0010_auto_20240625_0806.py

@@ -7,7 +7,7 @@ def set_file_preview(apps, schema_editor):
     ConnectorLeadPreviewAttachment = apps.get_model('unified_connector', 'ConnectorLeadPreviewAttachment')
     ConnectorLeadPreviewAttachment.objects.update(
         file_preview=models.F('file'),
-        type=2,
+        type=2,  # default type is image
     )
 
 

deep/urls.py

@@ -26,7 +26,7 @@
     unsubscribe_email,
 )
 from gallery.views import (
-    AttachmentFileView,
+    PrivateAttachmentFileView,
     FileView,
     FileViewSet,
     GoogleDriveFileViewSet,
@@ -438,7 +438,7 @@ def get_api_path(path):
     ),
     path(
         'external/private-file/<str:module>/<str:identifier>',
-        AttachmentFileView.as_view(),
+        PrivateAttachmentFileView.as_view(),
         name='external_private_url',
     ),
     re_path(