fix: changeform dropdown actions permissions (#1163)

Author: lukasvinclav

src/unfold/decorators.py

@@ -37,13 +37,19 @@ def inner(
                 # Permissions methods have following syntax: has_<some>_permission(self, request, obj=None):
                 # But obj is not examined by default in django admin and it would also require additional
                 # fetch from database, therefore it is not supported yet
-                has_object_argument = (
-                    func.__name__ in model_admin.actions_detail
-                    or func.__name__ in model_admin.actions_submit_line
+                has_detail_action = func.__name__ in model_admin._extract_action_names(
+                    model_admin.actions_detail
                 )
+                has_submit_line_action = (
+                    func.__name__
+                    in model_admin._extract_action_names(
+                        model_admin.actions_submit_line
+                    )
+                )
+
                 if not all(
                     has_permission(request, kwargs.get("object_id"))
-                    if has_object_argument
+                    if has_detail_action or has_submit_line_action
                     else has_permission(request)
                     for has_permission in permission_checks
                 ):

tests/fixtures.py

@@ -213,13 +213,19 @@ def has_changelist_row_action_false_permission(self, request):
         ######################################################################
         # Changeform actions
         ######################################################################
-        @action(description="Changeform action dropdown")
+        @action(
+            description="Changeform action dropdown",
+            permissions=["changeform_action_dropdown"],
+        )
         def changeform_action_dropdown(self, request, object_id):
             messages.success(
                 request, "Changeform action dropdown successfully executed"
             )
             return redirect(reverse_lazy("admin:example_user_changelist"))
 
+        def has_changeform_action_dropdown_permission(self, request, object_id):
+            return True
+
         @action(description="Changeform action")
         def changeform_action(self, request, object_id):
             messages.success(request, "Changeform action successfully executed")