Attachments v2

dev

@@ -103,7 +103,7 @@ intro() {
     echo "    ${BOLD}run${NORMAL}               runs \"docker compose run --rm misago\"."
     echo "    ${BOLD}psql${NORMAL}              runs psql connected to development database."
     echo "    ${BOLD}pyfmt${NORMAL}             runs isort + black on python code."
-    echo "    ${BOLD}loaddevfixture${NORMAL}      populates database with pre-made data for dev."
+    echo "    ${BOLD}loaddevfixture${NORMAL}    populates database with pre-made data for dev."
     echo "    ${BOLD}fakedata${NORMAL}          populates database with generated testing data."
     echo "    ${BOLD}fakebigdata${NORMAL}       populates database with LARGE amount of geerated testing data."
     echo "    ${BOLD}pipcompile${NORMAL}        run pip-compile to update requirements.txt"

dev-docs/plugins/hooks/can-upload-private-threads-attachments-hook.md

@@ -0,0 +1,86 @@
+# `can_upload_private_threads_attachments_hook`
+
+This hook wraps the standard Misago function that checks whether a user has permission to upload attachments in private threads.
+
+
+## Location
+
+This hook can be imported from `misago.permissions.hooks`:
+
+```python
+from misago.permissions.hooks import can_upload_private_threads_attachments_hook
+```
+
+
+## Filter
+
+```python
+def custom_can_upload_private_threads_attachments_filter(
+    action: CanUploadPrivateThreadsAttachmentsHookAction,
+    permissions: 'UserPermissionsProxy',
+) -> bool:
+    ...
+```
+
+A function implemented by a plugin that can be registered in this hook.
+
+
+### Arguments
+
+#### `action: CanUploadPrivateThreadsAttachmentsHookAction`
+
+A standard Misago function that checks whether a user has permission to upload attachments in private threads.
+
+See the [action](#action) section for details.
+
+
+#### `user_permissions: UserPermissionsProxy`
+
+A proxy object with the current user's permissions.
+
+
+### Return value
+
+`True` if a user can upload attachments in a category, and `False` if they cannot.
+
+
+## Action
+
+```python
+def can_upload_private_threads_attachments_action(permissions: 'UserPermissionsProxy') -> bool:
+    ...
+```
+
+A standard Misago function that checks whether a user has permission to upload attachments in private threads.
+
+
+### Arguments
+
+#### `user_permissions: UserPermissionsProxy`
+
+A proxy object with the current user's permissions.
+
+
+### Return value
+
+`True` if a user can upload attachments in a category, and `False` if they cannot.
+
+
+## Example
+
+The code below implements a custom filter function that prevents a user from uploading attachments in private threads if a custom flag is set on their account.
+
+```python
+from misago.permissions.hooks import can_upload_threads_attachments_hook
+from misago.permissions.proxy import UserPermissionsProxy
+
+@can_upload_private_threads_attachments_hook.append_filter
+def user_can_upload_attachments_in_category(
+    action,
+    permissions: UserPermissionsProxy,
+) -> bool:
+    if permissions.user.plugin_data.get("banned_private_threads_attachments"):
+        return False
+
+    result action(permissions)
+```

dev-docs/plugins/hooks/can-upload-threads-attachments-hook.md

@@ -0,0 +1,101 @@
+# `can_upload_threads_attachments_hook`
+
+This hook wraps the standard Misago function that checks whether a user has permission to upload attachments in a category.
+
+
+## Location
+
+This hook can be imported from `misago.permissions.hooks`:
+
+```python
+from misago.permissions.hooks import can_upload_threads_attachments_hook
+```
+
+
+## Filter
+
+```python
+def custom_can_upload_threads_attachments_filter(
+    action: CanUploadThreadsAttachmentsHookAction,
+    permissions: 'UserPermissionsProxy',
+    category: Category,
+) -> bool:
+    ...
+```
+
+A function implemented by a plugin that can be registered in this hook.
+
+
+### Arguments
+
+#### `action: CanUploadThreadsAttachmentsHookAction`
+
+A standard Misago function that checks if a user has permission to upload attachments in a category.
+
+See the [action](#action) section for details.
+
+
+#### `user_permissions: UserPermissionsProxy`
+
+A proxy object with the current user's permissions.
+
+
+#### `category: Category`
+
+A category to check permissions for.
+
+
+### Return value
+
+`True` if a user can upload attachments in a category, and `False` if they cannot.
+
+
+## Action
+
+```python
+def can_upload_threads_attachments_action(
+    permissions: 'UserPermissionsProxy', category: Category
+) -> bool:
+    ...
+```
+
+A standard Misago function that checks if a user has permission to upload attachments in a category.
+
+
+### Arguments
+
+#### `user_permissions: UserPermissionsProxy`
+
+A proxy object with the current user's permissions.
+
+
+#### `category: Category`
+
+A category to check permissions for.
+
+
+### Return value
+
+`True` if a user can upload attachments in a category, and `False` if they cannot.
+
+
+## Example
+
+The code below implements a custom filter function that prevents a user from uploading attachments in a specific category if a custom flag is set on their account.
+
+```python
+from misago.categories.models import Category
+from misago.permissions.hooks import can_upload_threads_attachments_hook
+from misago.permissions.proxy import UserPermissionsProxy
+
+@can_upload_threads_attachments_hook.append_filter
+def user_can_upload_attachments_in_category(
+    action,
+    permissions: UserPermissionsProxy,
+    category: Category,
+) -> bool:
+    if category.id in permissions.user.plugin_data.get("banned_attachments", []):
+        return False
+
+    result action(permissions, category)
+```

dev-docs/plugins/hooks/check-download-attachment-permission-hook.md

@@ -0,0 +1,138 @@
+# `check_download_attachment_permission_hook`
+
+This hook wraps the standard function that Misago uses to check if the user has permission to download an attachment. It raises Django's `Http404` if the user cannot see the attachment or `PermissionDenied` if they are not allowed to download it.
+
+
+## Location
+
+This hook can be imported from `misago.permissions.hooks`:
+
+```python
+from misago.permissions.hooks import check_download_attachment_permission_hook
+```
+
+
+## Filter
+
+```python
+def custom_check_download_attachment_permission_filter(
+    action: CheckDownloadAttachmentPermissionHookAction,
+    permissions: 'UserPermissionsProxy',
+    category: Category | None,
+    thread: Thread | None,
+    post: Post | None,
+    attachment: Attachment,
+) -> None:
+    ...
+```
+
+A function implemented by a plugin that can be registered in this hook.
+
+
+### Arguments
+
+#### `action: CheckDownloadAttachmentPermissionHookAction`
+
+A standard Misago function used to check if a user has permission to download an attachment. It raises Django's `Http404` if the user cannot see the attachment or `PermissionDenied` if they are not allowed to download it.
+
+See the [action](#action) section for details.
+
+
+#### `user_permissions: UserPermissionsProxy`
+
+A proxy object with the current user's permissions.
+
+
+#### `category: Category | None`
+
+A category to check permissions for, or `None` if the attachment wasn't posted.
+
+
+#### `thread: Thread | None`
+
+A thread to check permissions for, or `None` if the attachment wasn't posted.
+
+
+#### `post: Post | None`
+
+A post to check permissions for, or `None` if the attachment wasn't posted.
+
+
+#### `attachment: Attachment`
+
+An attachment to check permissions for.
+
+
+## Action
+
+```python
+def check_download_attachment_permission_action(
+    permissions: 'UserPermissionsProxy',
+    category: Category | None,
+    thread: Thread | None,
+    post: Post | None,
+    attachment: Attachment,
+) -> None:
+    ...
+```
+
+A standard Misago function used to check if a user has permission to download an attachment. It raises Django's `Http404` if the user cannot see the attachment or `PermissionDenied` if they are not allowed to download it.
+
+
+### Arguments
+
+#### `user_permissions: UserPermissionsProxy`
+
+A proxy object with the current user's permissions.
+
+
+#### `category: Category | None`
+
+A category to check permissions for, or `None` if the attachment wasn't posted.
+
+
+#### `thread: Thread | None`
+
+A thread to check permissions for, or `None` if the attachment wasn't posted.
+
+
+#### `post: Post | None`
+
+A post to check permissions for, or `None` if the attachment wasn't posted.
+
+
+#### `attachment: Attachment`
+
+An attachment to check permissions for.
+
+
+## Example
+
+The code below implements a custom filter function that prevents a user from downloading an attachment if its flagged by plugin.
+
+```python
+from django.http import Http404
+from misago.attachments.models import Attachment
+from misago.categories.models import Category
+from misago.permissions.hooks import check_download_attachment_permission_hook
+from misago.permissions.proxy import UserPermissionsProxy
+from misago.threads.models import Post, Thread
+
+@check_download_attachment_permission_hook.append_filter
+def check_user_can_download_attachment(
+    action,
+    permissions: UserPermissionsProxy,
+    category: Category | None,
+    thread: Thread | None,
+    post: Post | None,
+    attachment: Attachment,
+) -> None:
+    action(permissions, category, thread, post, attachment)
+
+    if not (
+        attachment.plugin_data.get("hidden")
+        and permissions.user.is_authenticated
+        and permissions.user.is_misago_admin
+    ):
+        raise Http404()
+```

dev-docs/plugins/hooks/check-edit-private-thread-post-permission-hook.md

@@ -98,7 +98,7 @@ def check_user_can_edit_thread(
     thread: Thread,
     post: Post,
 ) -> None:
-    action(permissions, category, post, thread)
+    action(permissions, thread, post)
 
     if (
         "[PROTECT]" in post.original