estelam ticket, varizha , others

apps/tickets/sharing_views.py

@@ -1,17 +1,15 @@
 """Routes available only to staff, including isolated message attachment delivery."""
-import mimetypes
 
-from django.conf import settings
 from django.contrib import messages
 from django.db import transaction
 from django.utils import timezone
 from django.core.exceptions import PermissionDenied, ValidationError
-from django.http import FileResponse, JsonResponse
+from django.http import JsonResponse
 from django.shortcuts import get_object_or_404, redirect
 from django.views.decorators.cache import never_cache
 from django.views.decorators.http import require_GET, require_POST
 
-from apps.attachments.delivery import signed_media_redirect
+from apps.attachments.delivery import attachment_response
 from apps.attachments.models import Attachment
 from .models import MessageShare, Ticket, TicketReadState
 from .policies import TicketPolicy
@@ -22,8 +20,11 @@ from .views import staff_required, mark_messages_read
 
 
 def received_message_share(request, share_id):
+    from .dispatch_responses import can_read_response
     grant = get_object_or_404(MessageShare.objects.select_related("message__author__staff_profile", "granted_by__staff_profile"), public_id=share_id)
     profile = getattr(request.user, "staff_profile", None)
+    if not can_read_response(request.user, grant.message):
+        raise PermissionDenied
     if (grant.user_id != request.user.pk or grant.revoked_at or grant.message.deleted_at
             or not request.user.is_active or not profile or not profile.is_active):
         raise PermissionDenied
@@ -72,6 +73,7 @@ def shared_message(request, share_id):
 @never_cache
 @transaction.atomic
 def read_shared_messages(request, public_id):
+    from .dispatch_responses import can_record_ticket_read
     ticket = get_object_or_404(Ticket.objects.select_for_update(), public_id=public_id)
     allowed = visible_messages(ticket, request.user)
     try:
@@ -86,7 +88,7 @@ def read_shared_messages(request, public_id):
         if grant.first_viewed_at is None:
             mark_share_opened(grant, request.user)
     latest = allowed.filter(deleted_at__isnull=True).order_by('-created_at', '-pk').first()
-    if latest and latest.public_id in accepted and TicketPolicy.can_view(request.user, ticket):
+    if latest and latest.public_id in accepted and can_record_ticket_read(ticket, request.user):
         TicketReadState.objects.update_or_create(ticket=ticket, user=request.user,
             defaults={'last_read_at': timezone.now(), 'last_read_message': latest})
     return JsonResponse({"unread_shares": unread_shares(request.user), "read_ids": [str(value) for value in accepted]})
@@ -105,9 +107,4 @@ def unread_count(request):
 def shared_attachment(request, share_id, attachment_id, download=False):
     grant = received_message_share(request, share_id)
     attachment = get_object_or_404(Attachment, public_id=attachment_id, message_id=grant.message_id)
-    if settings.USE_NGINX_MEDIA:
-        return signed_media_redirect(attachment.relative_path, download=download)
-    content_type = attachment.mime_type or mimetypes.guess_type(attachment.original_name)[0] or "application/octet-stream"
-    response = FileResponse(attachment.file.open("rb"), content_type=content_type, as_attachment=download, filename=attachment.original_name)
-    response["X-Content-Type-Options"] = "nosniff"
-    return response
+    return attachment_response(attachment, download=download)