Update incorrect test

server/api/documents.js

@@ -536,6 +536,7 @@ async function loadDocument({
 
     // If the user has access to read the document, we can just update
     // the last access date and return the document without additional checks.
+    document.fromShare = true;
     const canReadDocument = can(user, "read", document);
     if (canReadDocument) {
       await share.update({ lastAccessedAt: new Date() });

server/api/documents.test.js

@@ -1940,12 +1940,16 @@ describe("#documents.update", () => {
 
   it("should not add template to collection structure when publishing", async () => {
     const user = await buildUser();
-    const collection = await buildCollection({ teamId: user.teamId });
+    const collection = await buildCollection({
+      teamId: user.teamId,
+      userId: user.id,
+    });
     const template = await buildDocument({
       teamId: user.teamId,
       collectionId: collection.id,
       template: true,
       publishedAt: null,
+      userId: user.id,
     });
 
     const res = await server.post("/api/documents.update", {

server/policies/document.js

@@ -11,6 +11,13 @@ allow(User, "createDocument", Team, (user, team) => {
 });
 
 allow(User, ["read", "download"], Document, (user, document) => {
+  if (
+    !document.fromShare &&
+    !document.publishedAt &&
+    document.createdById !== user.id
+  )
+    return false;
+
   // existence of collection option is not required here to account for share tokens
   if (document.collection && cannot(user, "read", document.collection)) {
     return false;
@@ -23,6 +30,7 @@ allow(User, ["star", "unstar"], Document, (user, document) => {
   if (document.archivedAt) return false;
   if (document.deletedAt) return false;
   if (document.template) return false;
+  if (!document.publishedAt && document.createdById !== user.id) return false;
 
   invariant(
     document.collection,
@@ -36,6 +44,7 @@ allow(User, ["star", "unstar"], Document, (user, document) => {
 allow(User, "share", Document, (user, document) => {
   if (document.archivedAt) return false;
   if (document.deletedAt) return false;
+  if (!document.publishedAt && document.createdById !== user.id) return false;
 
   if (cannot(user, "share", document.collection)) {
     return false;
@@ -47,6 +56,7 @@ allow(User, "share", Document, (user, document) => {
 allow(User, "update", Document, (user, document) => {
   if (document.archivedAt) return false;
   if (document.deletedAt) return false;
+  if (!document.publishedAt && document.createdById !== user.id) return false;
 
   if (cannot(user, "update", document.collection)) {
     return false;
@@ -102,6 +112,7 @@ allow(User, ["pin", "unpin"], Document, (user, document) => {
 allow(User, "delete", Document, (user, document) => {
   if (user.isViewer) return false;
   if (document.deletedAt) return false;
+  if (!document.publishedAt && document.createdById !== user.id) return false;
 
   // allow deleting document without a collection
   if (document.collection && cannot(user, "update", document.collection)) {
@@ -109,11 +120,7 @@ allow(User, "delete", Document, (user, document) => {
   }
 
   // unpublished drafts can always be deleted
-  if (
-    !document.deletedAt &&
-    !document.publishedAt &&
-    user.teamId === document.teamId
-  ) {
+  if (!document.publishedAt && user.teamId === document.teamId) {
     return true;
   }