Repository: paperless-ngx/paperless-ngx

Issue:
[BUG] User without write permissions can add note
### Description

The user is able to add notes to documents who that user only has view permissions to.

### Steps to reproduce

1. Set owner to User_A on a document.
2. Set User_B, or a group User_B is member of to have view-permission on the document
3. User_B can view as normal, can not edit Details or Content, but can add Notes.

The note-add wil load forever(?) until user hit F5 and the note is there.
![image](https://github.com/paperless-ngx/paperless-ngx/assets/25674067/64e93922-9769-4474-9604-d12ff568a323)
*F5*
![image](https://github.com/paperless-ngx/paperless-ngx/assets/25674067/77969e0c-a8f3-4f27-9ca6-4b649e2b8660)

RESULT:
The note is stored for the document.
COMMENT: I don't know if this is by design, but with that error in the log i guess not.

### Webserver logs

```bash
[2023-07-31 21:24:27,569] [WARNING] [paperless.api] An error occurred saving note: You do not have permission to perform this action.
```


### Browser logs

_No response_

### Paperless-ngx version

1.16.5

### Host OS

UnRAID,

### Installation method

Docker - official image

### Browser

Google Chrome

### Configuration changes

_No response_

### Other

_No response_


Discussion:

Resolving patch:
diff --git a/src/documents/views.py b/src/documents/views.py
--- a/src/documents/views.py
+++ b/src/documents/views.py
@@ -502,19 +502,18 @@ def getNotes(self, doc):
 
     @action(methods=["get", "post", "delete"], detail=True)
     def notes(self, request, pk=None):
+        currentUser = request.user
         try:
             doc = Document.objects.get(pk=pk)
-            if request.user is not None and not has_perms_owner_aware(
-                request.user,
+            if currentUser is not None and not has_perms_owner_aware(
+                currentUser,
                 "view_document",
                 doc,
             ):
-                return HttpResponseForbidden("Insufficient permissions")
+                return HttpResponseForbidden("Insufficient permissions to view")
         except Document.DoesNotExist:
             raise Http404
 
-        currentUser = request.user
-
         if request.method == "GET":
             try:
                 return Response(self.getNotes(doc))
@@ -525,6 +524,13 @@ def notes(self, request, pk=None):
                 )
         elif request.method == "POST":
             try:
+                if currentUser is not None and not has_perms_owner_aware(
+                    currentUser,
+                    "change_document",
+                    doc,
+                ):
+                    return HttpResponseForbidden("Insufficient permissions to create")
+
                 c = Note.objects.create(
                     document=doc,
                     note=request.data["note"],
@@ -545,6 +551,13 @@ def notes(self, request, pk=None):
                     },
                 )
         elif request.method == "DELETE":
+            if currentUser is not None and not has_perms_owner_aware(
+                currentUser,
+                "change_document",
+                doc,
+            ):
+                return HttpResponseForbidden("Insufficient permissions to delete")
+
             note = Note.objects.get(id=int(request.GET.get("id")))
             note.delete()
 


Test patch:
diff --git a/src/documents/tests/test_api.py b/src/documents/tests/test_api.py
--- a/src/documents/tests/test_api.py
+++ b/src/documents/tests/test_api.py
@@ -2369,6 +2369,62 @@ def test_create_note(self):
 
         self.assertEqual(resp_data["note"], "this is a posted note")
 
+    def test_notes_permissions_aware(self):
+        """
+        GIVEN:
+            - Existing document owned by user2 but with granted view perms for user1
+        WHEN:
+            - API request is made by user1 to add a note or delete
+        THEN:
+            - Notes are neither created nor deleted
+        """
+        user1 = User.objects.create_user(username="test1")
+        user1.user_permissions.add(*Permission.objects.all())
+        user1.save()
+
+        user2 = User.objects.create_user(username="test2")
+        user2.save()
+
+        doc = Document.objects.create(
+            title="test",
+            mime_type="application/pdf",
+            content="this is a document which will have notes added",
+        )
+        doc.owner = user2
+        doc.save()
+
+        self.client.force_authenticate(user1)
+
+        resp = self.client.get(
+            f"/api/documents/{doc.pk}/notes/",
+            format="json",
+        )
+        self.assertEqual(resp.content, b"Insufficient permissions to view")
+        self.assertEqual(resp.status_code, status.HTTP_403_FORBIDDEN)
+
+        assign_perm("view_document", user1, doc)
+
+        resp = self.client.post(
+            f"/api/documents/{doc.pk}/notes/",
+            data={"note": "this is a posted note"},
+        )
+        self.assertEqual(resp.content, b"Insufficient permissions to create")
+        self.assertEqual(resp.status_code, status.HTTP_403_FORBIDDEN)
+
+        note = Note.objects.create(
+            note="This is a note.",
+            document=doc,
+            user=user2,
+        )
+
+        response = self.client.delete(
+            f"/api/documents/{doc.pk}/notes/?id={note.pk}",
+            format="json",
+        )
+
+        self.assertEqual(response.content, b"Insufficient permissions to delete")
+        self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
+
     def test_delete_note(self):
         """
         GIVEN: