Make sure permissions are respected.

see #844

modoboa/admin/serializers.py

@@ -180,7 +180,9 @@ class AliasSerializer(serializers.ModelSerializer):
         local_part, domain = email_utils.split_mailbox(value)
         self.domain = admin_models.Domain.objects.filter(name=domain).first()
         if self.domain is None:
-            raise serializers.ValidationError("Domain not found.")
+            raise serializers.ValidationError(_("Domain not found."))
+        if not self.context["request"].user.can_access(self.domain):
+            raise serializers.ValidationError(_("Permission denied."))
         return value
 
     def create(self, validated_data):

modoboa/admin/tests/api.py

@@ -334,6 +334,21 @@ class AliasAPITestCase(ModoAPITestCase):
         response = self.client.post(url, data, format="json")
         self.assertEqual(response.status_code, 201)
 
+    def test_create_alias_as_domadmin(self):
+        """As DomainAdmin, try to create a new alias."""
+        self.client.credentials(
+            HTTP_AUTHORIZATION='Token ' + self.da_token.key)
+        url = reverse("external_api:alias-list")
+        response = self.client.post(url, self.ALIAS_DATA, format="json")
+        self.assertEqual(response.status_code, 201)
+
+        data = copy.deepcopy(self.ALIAS_DATA)
+        data["address"] = "alias_fromapi@test2.com"
+        response = self.client.post(url, data, format="json")
+        self.assertEqual(response.status_code, 400)
+        errors = json.loads(response.content)
+        self.assertIn("address", errors)
+
     def test_update_alias(self):
         """Try to update an alias."""
         alias = models.Alias.objects.get(address="alias@test.com")