From d6040245848395d0a45c09dbbbf2d50eafea362e Mon Sep 17 00:00:00 2001
From: Kevin <kbhowbrook@gmail.com>
Date: Fri, 6 Feb 2026 11:19:17 +0000
Subject: [PATCH] Prevent creating draftsharing link snippets via admin

Introduce a custom permission policy to disable the add action on the draftsharing link snippet viewset and add admin view tests to ensure the add button is hidden.
---
 wagtaildraftsharing/snippets.py         | 10 +++++++++-
 wagtaildraftsharing/tests/test_views.py | 25 +++++++++++++++++++++++++
 2 files changed, 34 insertions(+), 1 deletion(-)

diff --git a/wagtaildraftsharing/snippets.py b/wagtaildraftsharing/snippets.py
index 1b0c8fb..0be3c8f 100644
--- a/wagtaildraftsharing/snippets.py
+++ b/wagtaildraftsharing/snippets.py
@@ -2,9 +2,15 @@
 from wagtail.snippets.views.snippets import SnippetViewSet
 
 from wagtaildraftsharing.models import WagtaildraftsharingLink
+from wagtail.permission_policies import ModelPermissionPolicy
 
 from .settings import settings as draftsharing_settings
 
+class NoAddPermissionPolicy(ModelPermissionPolicy):
+    def user_has_permission(self, user, action):
+        if action == 'add':
+            return False
+        return super().user_has_permission(user, action)
 
 class WagtaildraftsharingLinkSnippetViewSet(SnippetViewSet):
     model = WagtaildraftsharingLink
@@ -16,6 +22,9 @@ class WagtaildraftsharingLinkSnippetViewSet(SnippetViewSet):
     list_display = ("__str__", "is_active", "created_by", "share_url")
     list_filter = ("is_active",)
 
+    # Use custom permission policy so adding from this view is disabled
+    permission_policy = NoAddPermissionPolicy(WagtaildraftsharingLink)
+
     edit_handler = ObjectList([
         FieldPanel("revision", read_only=True),
         FieldPanel(
@@ -33,7 +42,6 @@ class WagtaildraftsharingLinkSnippetViewSet(SnippetViewSet):
         ),
     ])
 
-
     def get_queryset(self, request):
         return WagtaildraftsharingLink.objects.all().prefetch_related(
             "revision", "revision__content_object", "created_by"
diff --git a/wagtaildraftsharing/tests/test_views.py b/wagtaildraftsharing/tests/test_views.py
index 5e73817..9539e8f 100644
--- a/wagtaildraftsharing/tests/test_views.py
+++ b/wagtaildraftsharing/tests/test_views.py
@@ -10,6 +10,7 @@
 from wagtail_factories import PageFactory
 
 from wagtaildraftsharing.models import WagtaildraftsharingLink
+from wagtaildraftsharing.snippets import WagtaildraftsharingLinkSnippetViewSet
 from wagtaildraftsharing.views import CreateSharingLinkView, SharingLinkView
 
 User = get_user_model()
@@ -197,3 +198,27 @@ def test_sharing_link_includes_robots_header(self):
 
         self.assertEqual(response.status_code, 200)
         self.assertEqual(response["X-Robots-Tag"], "noindex, nofollow")
+
+
+class WagtaildraftsharingLinkSnippetAdminViewTests(TestCase):
+    @classmethod
+    def setUpTestData(cls):
+        super().setUpTestData()
+        cls.superuser = User.objects.create_superuser(
+            username="admin",
+            password="test",
+        )
+
+    def test_snippet_list_does_not_show_add_button_for_superuser(self):
+        # Superusers would normally be allowed to add snippets, but our
+        # custom permission policy should disable the "Add" action.
+        self.client.login(username="admin", password="test")
+
+        viewset = WagtaildraftsharingLinkSnippetViewSet()
+        list_url = reverse(viewset.get_url_name("list"))
+
+        response = self.client.get(list_url)
+        self.assertEqual(response.status_code, 200)
+        self.assertNotContains(response, "Add Draftsharing Link")
+        # Occasionally the "Add Sharing Link" pops up too...
+        self.assertNotContains(response, "Add Sharing Link")