Merge branch '284-documentation-is-created-before-permission-check' into 'master'

Resolve "Documentation is created before permission check"

Closes #284

See merge request !397

aleksis/apps/alsijil/models.py

@@ -709,7 +709,10 @@ class Documentation(CalendarEvent):
                 *cls.parse_dummy(_id),
             ), True
 
-        return cls.objects.get(id=_id), False
+        obj = cls.objects.get(id=_id)
+        if not user.has_perm("alsijil.edit_documentation_rule", obj):
+            raise PermissionDenied()
+        return obj, False
 
     def touch(self):
         """Ensure that participation statuses are created for this documentation."""

aleksis/apps/alsijil/schema/documentation.py

@@ -110,9 +110,6 @@ class DocumentationBatchCreateOrUpdateMutation(graphene.Mutation):
         # is only introduced in Django 5.0
         obj, __ = Documentation.get_or_create_by_id(_id, info.context.user)
 
-        if not info.context.user.has_perm("alsijil.edit_documentation_rule", obj):
-            raise PermissionDenied()
-
         if doc.topic is not None:
             obj.topic = doc.topic
         if doc.homework is not None: