deploy from github actions

app/routers/alabanza.py

@@ -604,6 +604,8 @@ def get_grupo_pistas(grupo_id: int, db: Session = Depends(get_db), current_user:
     ug = db.query(UserGroup).filter(UserGroup.user_id == current_user.id, UserGroup.group_id == grupo_id, UserGroup.estado == "activo").first()
     if not ug:
         raise HTTPException(status_code=403, detail="No eres miembro de este grupo")
+    if ug.role != "admin" and not ug.perm_ver_pistas:
+        raise HTTPException(status_code=403, detail="No tienes permisos para ver las pistas de este grupo")
         
     tasks = db.query(Task).filter(Task.groups_shared.any(Group.id == grupo_id)).all()
     return [
@@ -630,6 +632,8 @@ def get_grupo_letras(grupo_id: int, db: Session = Depends(get_db), current_user:
     ug = db.query(UserGroup).filter(UserGroup.user_id == current_user.id, UserGroup.group_id == grupo_id, UserGroup.estado == "activo").first()
     if not ug:
         raise HTTPException(status_code=403, detail="No eres miembro de este grupo")
+    if ug.role != "admin" and not ug.perm_ver_letras:
+        raise HTTPException(status_code=403, detail="No tienes permisos para ver las letras de este grupo")
         
     lyrics = db.query(Lyric).filter(Lyric.groups_shared.any(Group.id == grupo_id)).all()
     return [
@@ -651,6 +655,8 @@ def get_grupo_repertorios(grupo_id: int, db: Session = Depends(get_db), current_
     ug = db.query(UserGroup).filter(UserGroup.user_id == current_user.id, UserGroup.group_id == grupo_id, UserGroup.estado == "activo").first()
     if not ug:
         raise HTTPException(status_code=403, detail="No eres miembro de este grupo")
+    if ug.role != "admin" and not ug.perm_ver_repertorios:
+        raise HTTPException(status_code=403, detail="No tienes permisos para ver los repertorios de este grupo")
         
     repertorios = db.query(Repertorio).filter(Repertorio.group_id == grupo_id).all()
     

app/routers/lyrics.py

@@ -99,10 +99,15 @@ def get_lyric(lyric_id: int, db: Session = Depends(get_db), current_user: User =
     db_lyric = db.query(Lyric).filter(Lyric.id == lyric_id).first()
     if not db_lyric:
         raise HTTPException(status_code=404, detail="Lyric not found")
-    user_group_ids = [ug.group_id for ug in current_user.groups if ug.estado == "activo"]
-    has_common_group = any(gid in user_group_ids for gid in db_lyric.group_ids)
-    if not has_common_group and db_lyric.created_by != current_user.id:
-        raise HTTPException(status_code=403, detail="Not authorized to view this lyric")
+    if db_lyric.created_by != current_user.id:
+        user_groups_with_perm = db.query(UserGroup).filter(
+            UserGroup.user_id == current_user.id,
+            UserGroup.estado == "activo",
+            UserGroup.group_id.in_(db_lyric.group_ids),
+            (UserGroup.role == "admin") | (UserGroup.perm_ver_letras == True)
+        ).first()
+        if not user_groups_with_perm:
+            raise HTTPException(status_code=403, detail="Not authorized to view this lyric")
     return db_lyric
 
 @router.put("/{lyric_id}", response_model=LyricOut)
@@ -212,14 +217,24 @@ def create_repertoire(rep: RepertorioCreate, db: Session = Depends(get_db), curr
 
 @router.put("/repertorios/{id}", response_model=RepertorioOut)
 def update_repertoire(id: int, rep: RepertorioCreate, db: Session = Depends(get_db), current_user: User = Depends(get_current_user)):
-    db_rep = db.query(Repertorio).filter(Repertorio.id == id, Repertorio.created_by == current_user.id).first()
+    db_rep = db.query(Repertorio).filter(Repertorio.id == id).first()
     if not db_rep:
         raise HTTPException(status_code=404, detail="Repertoire not found")
         
-    if db_rep.group_id is not None:
-        ug = db.query(UserGroup).filter(UserGroup.user_id == current_user.id, UserGroup.group_id == db_rep.group_id, UserGroup.estado == "activo").first()
-        if ug and ug.role != "admin" and not ug.perm_crud_repertorios:
-            raise HTTPException(status_code=403, detail="No tienes permisos para editar repertorios de este grupo")
+    is_authorized = False
+    if db_rep.created_by == current_user.id:
+        is_authorized = True
+    elif db_rep.group_id is not None:
+        ug = db.query(UserGroup).filter(
+            UserGroup.user_id == current_user.id,
+            UserGroup.group_id == db_rep.group_id,
+            UserGroup.estado == "activo"
+        ).first()
+        if ug and (ug.role == "admin" or ug.perm_crud_repertorios):
+            is_authorized = True
+            
+    if not is_authorized:
+        raise HTTPException(status_code=403, detail="No tienes permisos para editar este repertorio")
             
     db_rep.name = rep.name
     db_rep.group_id = rep.group_id
@@ -247,14 +262,24 @@ def update_repertoire(id: int, rep: RepertorioCreate, db: Session = Depends(get_
 
 @router.delete("/repertorios/{id}")
 def delete_repertoire(id: int, db: Session = Depends(get_db), current_user: User = Depends(get_current_user)):
-    db_rep = db.query(Repertorio).filter(Repertorio.id == id, Repertorio.created_by == current_user.id).first()
+    db_rep = db.query(Repertorio).filter(Repertorio.id == id).first()
     if not db_rep:
         raise HTTPException(status_code=404, detail="Repertoire not found")
         
-    if db_rep.group_id is not None:
-        ug = db.query(UserGroup).filter(UserGroup.user_id == current_user.id, UserGroup.group_id == db_rep.group_id, UserGroup.estado == "activo").first()
-        if ug and ug.role != "admin" and not ug.perm_crud_repertorios:
-            raise HTTPException(status_code=403, detail="No tienes permisos para eliminar repertorios de este grupo")
+    is_authorized = False
+    if db_rep.created_by == current_user.id:
+        is_authorized = True
+    elif db_rep.group_id is not None:
+        ug = db.query(UserGroup).filter(
+            UserGroup.user_id == current_user.id,
+            UserGroup.group_id == db_rep.group_id,
+            UserGroup.estado == "activo"
+        ).first()
+        if ug and (ug.role == "admin" or ug.perm_crud_repertorios):
+            is_authorized = True
+            
+    if not is_authorized:
+        raise HTTPException(status_code=403, detail="No tienes permisos para eliminar este repertorio")
         
     group_id = db_rep.group_id
     db.query(RepertorioLyric).filter(RepertorioLyric.repertorio_id == id).delete()
@@ -270,14 +295,24 @@ def delete_repertoire(id: int, db: Session = Depends(get_db), current_user: User
 
 @router.post("/repertorios/{id}/lyrics")
 def add_lyric_to_repertoire(id: int, lyric_id: int, db: Session = Depends(get_db), current_user: User = Depends(get_current_user)):
-    db_rep = db.query(Repertorio).filter(Repertorio.id == id, Repertorio.created_by == current_user.id).first()
+    db_rep = db.query(Repertorio).filter(Repertorio.id == id).first()
     if not db_rep:
         raise HTTPException(status_code=404, detail="Repertoire not found")
         
-    if db_rep.group_id is not None:
-        ug = db.query(UserGroup).filter(UserGroup.user_id == current_user.id, UserGroup.group_id == db_rep.group_id, UserGroup.estado == "activo").first()
-        if ug and ug.role != "admin" and not ug.perm_crud_repertorios:
-            raise HTTPException(status_code=403, detail="No tienes permisos para modificar repertorios de este grupo")
+    is_authorized = False
+    if db_rep.created_by == current_user.id:
+        is_authorized = True
+    elif db_rep.group_id is not None:
+        ug = db.query(UserGroup).filter(
+            UserGroup.user_id == current_user.id,
+            UserGroup.group_id == db_rep.group_id,
+            UserGroup.estado == "activo"
+        ).first()
+        if ug and (ug.role == "admin" or ug.perm_crud_repertorios):
+            is_authorized = True
+            
+    if not is_authorized:
+        raise HTTPException(status_code=403, detail="No tienes permisos para modificar este repertorio")
         
     exists = db.query(RepertorioLyric).filter_by(repertorio_id=id, lyric_id=lyric_id).first()
     if exists:
@@ -303,6 +338,20 @@ def get_repertoire(id: int, db: Session = Depends(get_db), current_user: User =
     if not rep:
         raise HTTPException(status_code=404, detail="Repertoire not found")
         
+    if rep.group_id is not None:
+        ug = db.query(UserGroup).filter(
+            UserGroup.user_id == current_user.id,
+            UserGroup.group_id == rep.group_id,
+            UserGroup.estado == "activo"
+        ).first()
+        if not ug:
+            raise HTTPException(status_code=403, detail="No tienes acceso a este repertorio")
+        if ug.role != "admin" and not ug.perm_ver_repertorios and rep.created_by != current_user.id:
+            raise HTTPException(status_code=403, detail="No tienes permisos para ver este repertorio")
+    else:
+        if rep.created_by != current_user.id:
+            raise HTTPException(status_code=403, detail="No tienes acceso a este repertorio")
+        
     # Ordenar letras por el campo 'order'
     sorted_lyrics = sorted(rep.lyrics, key=lambda x: x.order if x.order is not None else 0)
     lyrics = [rl.lyric for rl in sorted_lyrics]
@@ -444,8 +493,14 @@ def share_lyric(
     is_owner = lyric.created_by == current_user.id
     is_group_admin = ug.role == "admin"
     
-    if not is_owner and not is_group_admin:
-        raise HTTPException(status_code=403, detail="No tienes permisos para modificar el estado compartido de esta letra (debes ser el creador o administrador del grupo)")
+    # Para "share": creador, admin, o miembro con perm_compartir_letras
+    # Para "unshare": sólo creador o admin (para no desvincular letras ajenas)
+    if data.action == "share":
+        if not is_owner and not is_group_admin and not ug.perm_compartir_letras:
+            raise HTTPException(status_code=403, detail="No tienes permisos para compartir letras con este grupo")
+    elif data.action == "unshare":
+        if not is_owner and not is_group_admin:
+            raise HTTPException(status_code=403, detail="Solo el creador o un administrador puede desvincular esta letra del grupo")
         
     group = db.query(Group).filter(Group.id == data.group_id).first()
     if not group:

app/routers/songs.py

@@ -859,8 +859,14 @@ def share_song(
     is_owner = task.user_id == current_user.id
     is_group_admin = ug.role == "admin"
     
-    if not is_owner and not is_group_admin:
-        raise HTTPException(status_code=403, detail="No tienes permisos para modificar el estado compartido de esta pista (debes ser el propietario o administrador del grupo)")
+    # Para "share": propietario, admin, o miembro con perm_compartir_pistas
+    # Para "unshare": sólo propietario o admin (para no quitar pistas ajenas)
+    if data.action == "share":
+        if not is_owner and not is_group_admin and not ug.perm_compartir_pistas:
+            raise HTTPException(status_code=403, detail="No tienes permisos para compartir pistas con este grupo")
+    elif data.action == "unshare":
+        if not is_owner and not is_group_admin:
+            raise HTTPException(status_code=403, detail="Solo el propietario o un administrador puede desvincular esta pista del grupo")
         
     group = db.query(Group).filter(Group.id == data.group_id).first()
     if not group:
@@ -969,6 +975,16 @@ def get_task_by_id(
     if not task:
         raise HTTPException(status_code=404, detail="Tarea no encontrada o sin acceso")
         
+    if task.user_id != current_user.id:
+        user_groups_with_perm = db.query(UserGroup).filter(
+            UserGroup.user_id == current_user.id,
+            UserGroup.estado == "activo",
+            UserGroup.group_id.in_([g.id for g in task.groups_shared]),
+            (UserGroup.role == "admin") | (UserGroup.perm_ver_pistas == True)
+        ).first()
+        if not user_groups_with_perm:
+            raise HTTPException(status_code=403, detail="No tienes permisos para ver esta pista")
+        
     import json as _json
     return {
         "id": task.id,
@@ -1004,9 +1020,19 @@ async def get_stems(
     task_record = db.query(Task).filter(Task.task_id == task_id).filter(
         (Task.user_id == current_user.id) | (Task.groups_shared.any(Group.id.in_(user_group_ids)))
     ).first()
-
+ 
     if not task_record:
         raise HTTPException(status_code=404, detail="Tarea no encontrada")
+        
+    if task_record.user_id != current_user.id:
+        user_groups_with_perm = db.query(UserGroup).filter(
+            UserGroup.user_id == current_user.id,
+            UserGroup.estado == "activo",
+            UserGroup.group_id.in_([g.id for g in task_record.groups_shared]),
+            (UserGroup.role == "admin") | (UserGroup.perm_ver_pistas == True)
+        ).first()
+        if not user_groups_with_perm:
+            raise HTTPException(status_code=403, detail="No tienes permisos para acceder a los stems de esta pista")
 
     # Dynamic expiration healing: if files expired, clean up DB state and return 404
     from datetime import datetime
@@ -1248,13 +1274,22 @@ async def harmony_status(
     """
     Consulta el estado de generación de armonías vocales de coro.
     """
-    # Validar que la tarea pertenece al usuario
-    task_record = db.query(Task).filter(
-        Task.task_id == task_id,
-        Task.user_id == current_user.id
+    user_group_ids = [ug.group_id for ug in current_user.groups if ug.estado == 'activo']
+    task_record = db.query(Task).filter(Task.task_id == task_id).filter(
+        (Task.user_id == current_user.id) | (Task.groups_shared.any(Group.id.in_(user_group_ids)))
     ).first()
     if not task_record:
-        raise HTTPException(status_code=404, detail="Tarea no encontrada o no pertenece al usuario")
+        raise HTTPException(status_code=404, detail="Tarea no encontrada")
+        
+    if task_record.user_id != current_user.id:
+        user_groups_with_perm = db.query(UserGroup).filter(
+            UserGroup.user_id == current_user.id,
+            UserGroup.estado == "activo",
+            UserGroup.group_id.in_([g.id for g in task_record.groups_shared]),
+            (UserGroup.role == "admin") | (UserGroup.perm_ver_pistas == True)
+        ).first()
+        if not user_groups_with_perm:
+            raise HTTPException(status_code=403, detail="No tienes permisos para ver esta pista")
 
     # 1. Comprobar si ya existen en la base de datos (B2/Tebi URLs)
     import json as _json

tests/test_group_permissions.py

@@ -0,0 +1,355 @@
+import sys
+import os
+import unittest
+from unittest.mock import MagicMock
+
+# Force environment variables for tests
+os.environ["SUPABASE_JWT_SECRET"] = "supersecretkey_change_me_in_production"
+os.environ["SECRET_KEY"] = "supersecretkey_change_me_in_production"
+os.environ["REDIS_URL"] = "rpc://"
+
+# Mock heavy dependencies
+sys.modules['librosa'] = MagicMock()
+sys.modules['torch'] = MagicMock()
+sys.modules['yt_dlp'] = MagicMock()
+sys.modules['pretty_midi'] = MagicMock()
+sys.modules['numpy'] = MagicMock()
+sys.modules['demucs'] = MagicMock()
+sys.modules['demucs.separate'] = MagicMock()
+
+# Include MelodixAPI in python path
+sys.path.append(os.path.abspath(os.path.join(os.path.dirname(__file__), "..")))
+
+from fastapi.testclient import TestClient
+from sqlalchemy import create_engine
+from sqlalchemy.orm import sessionmaker
+
+from app.database import Base, get_db
+from app.models.user import User, Device
+from app.models.lyrics import Group, UserGroup, Lyric, Repertorio
+from app.models.process import Task
+from main import app
+
+TEST_DATABASE_URL = "sqlite:///./test_group_perms.db"
+engine = create_engine(TEST_DATABASE_URL, connect_args={"check_same_thread": False})
+TestingSessionLocal = sessionmaker(autocommit=False, autoflush=False, bind=engine)
+
+def override_get_db():
+    db = TestingSessionLocal()
+    try:
+        yield db
+    finally:
+        db.close()
+
+app.dependency_overrides[get_db] = override_get_db
+
+class TestGroupPermissions(unittest.TestCase):
+
+    @classmethod
+    def setUpClass(cls):
+        Base.metadata.create_all(bind=engine)
+        cls.client = TestClient(app)
+
+    @classmethod
+    def tearDownClass(cls):
+        Base.metadata.drop_all(bind=engine)
+        if os.path.exists("./test_group_perms.db"):
+            try:
+                os.remove("./test_group_perms.db")
+            except Exception:
+                pass
+
+    def setUp(self):
+        db = TestingSessionLocal()
+        db.query(Task).delete()
+        db.query(UserGroup).delete()
+        db.query(Lyric).delete()
+        db.query(Repertorio).delete()
+        db.query(Group).delete()
+        db.query(Device).delete()
+        db.query(User).delete()
+        db.commit()
+        db.close()
+
+    def _create_user_and_token(self, username, email):
+        payload = {"username": username, "email": email, "password": "password123"}
+        self.client.post("/auth/register", json=payload)
+        
+        login_res = self.client.post("/auth/token", data={
+            "username": email,
+            "password": "password123",
+            "device_id": f"dev_{username}",
+            "device_name": "Test Device"
+        })
+        token = login_res.json()["access_token"]
+        user_id = login_res.json()["user"]["id"]
+        return {"Authorization": f"Bearer {token}"}, user_id
+
+    def test_lyrics_sharing_permissions(self):
+        """Test sharing lyrics based on perm_compartir_letras granular permission"""
+        headers_a, id_a = self._create_user_and_token("user_a", "a@example.com")
+        headers_b, id_b = self._create_user_and_token("user_b", "b@example.com")
+
+        # User A creates group
+        g_res = self.client.post("/lyrics/groups", json={"name": "Grupo A"}, headers=headers_a)
+        self.assertEqual(g_res.status_code, 200)
+        group_id = g_res.json()["id"]
+
+        # Generate invitation and join B
+        inv_res = self.client.post(f"/lyrics/groups/{group_id}/invite", headers=headers_a)
+        code = inv_res.json()["code"]
+        self.client.post(f"/lyrics/join/{code}", headers=headers_b)
+
+        # User B creates a lyric
+        l_res = self.client.post("/lyrics", json={
+            "title": "Lyric B", "artist": "Artist B", "content": "Content B", "group_id": None
+        }, headers=headers_b)
+        self.assertEqual(l_res.status_code, 200)
+        lyric_id = l_res.json()["id"]
+
+        # By default B can share
+        share_res = self.client.post(f"/lyrics/{lyric_id}/share", json={"group_id": group_id, "action": "share"}, headers=headers_b)
+        self.assertEqual(share_res.status_code, 200)
+
+        # Unshare
+        unshare_res = self.client.post(f"/lyrics/{lyric_id}/share", json={"group_id": group_id, "action": "unshare"}, headers=headers_b)
+        self.assertEqual(unshare_res.status_code, 200)
+
+        # Disable perm_compartir_letras for User B
+        requests_json = {
+            "perm_compartir_pistas": True,
+            "perm_compartir_letras": False,  # Disabled
+            "perm_crud_repertorios": False,
+            "perm_crud_letras": True,
+            "perm_ver_pistas": True,
+            "perm_ver_letras": True,
+            "perm_ver_repertorios": True,
+            "perm_gestionar_solicitudes": False
+        }
+        update_perm = self.client.put(f"/alabanza/grupos/{group_id}/miembros/{id_b}/permisos", json=requests_json, headers=headers_a)
+        self.assertEqual(update_perm.status_code, 200)
+
+        # User B tries to share -> 403 Forbidden
+        share_res = self.client.post(f"/lyrics/{lyric_id}/share", json={"group_id": group_id, "action": "share"}, headers=headers_b)
+        self.assertEqual(share_res.status_code, 403)
+
+    def test_lyrics_view_permissions(self):
+        """Test viewing lyrics in group and get_lyric based on perm_ver_letras"""
+        headers_a, id_a = self._create_user_and_token("user_a", "a@example.com")
+        headers_b, id_b = self._create_user_and_token("user_b", "b@example.com")
+
+        # User A creates group
+        g_res = self.client.post("/lyrics/groups", json={"name": "Grupo A"}, headers=headers_a)
+        group_id = g_res.json()["id"]
+
+        # Join B
+        inv_res = self.client.post(f"/lyrics/groups/{group_id}/invite", headers=headers_a)
+        code = inv_res.json()["code"]
+        self.client.post(f"/lyrics/join/{code}", headers=headers_b)
+
+        # User A creates and shares a lyric
+        l_res = self.client.post("/lyrics", json={
+            "title": "Lyric A", "artist": "Artist A", "content": "Content A", "group_id": group_id
+        }, headers=headers_a)
+        lyric_id = l_res.json()["id"]
+
+        # User B can view by default
+        get_res = self.client.get(f"/lyrics/{lyric_id}", headers=headers_b)
+        self.assertEqual(get_res.status_code, 200)
+
+        list_res = self.client.get(f"/alabanza/grupos/{group_id}/letras", headers=headers_b)
+        self.assertEqual(list_res.status_code, 200)
+        self.assertEqual(len(list_res.json()), 1)
+
+        # Disable perm_ver_letras
+        requests_json = {
+            "perm_compartir_pistas": True,
+            "perm_compartir_letras": True,
+            "perm_crud_repertorios": False,
+            "perm_crud_letras": True,
+            "perm_ver_pistas": True,
+            "perm_ver_letras": False,  # Disabled
+            "perm_ver_repertorios": True,
+            "perm_gestionar_solicitudes": False
+        }
+        update_perm = self.client.put(f"/alabanza/grupos/{group_id}/miembros/{id_b}/permisos", json=requests_json, headers=headers_a)
+        self.assertEqual(update_perm.status_code, 200)
+
+        # User B tries to view group lyrics -> 403
+        list_res = self.client.get(f"/alabanza/grupos/{group_id}/letras", headers=headers_b)
+        self.assertEqual(list_res.status_code, 403)
+
+        # User B tries to view individual lyric -> 403
+        get_res = self.client.get(f"/lyrics/{lyric_id}", headers=headers_b)
+        self.assertEqual(get_res.status_code, 403)
+
+    def test_repertoire_crud_permissions(self):
+        """Test creating, editing, and deleting repertoires based on perm_crud_repertorios"""
+        headers_a, id_a = self._create_user_and_token("user_a", "a@example.com")
+        headers_b, id_b = self._create_user_and_token("user_b", "b@example.com")
+
+        # User A creates group
+        g_res = self.client.post("/lyrics/groups", json={"name": "Grupo A"}, headers=headers_a)
+        group_id = g_res.json()["id"]
+
+        # Join B
+        inv_res = self.client.post(f"/lyrics/groups/{group_id}/invite", headers=headers_a)
+        code = inv_res.json()["code"]
+        self.client.post(f"/lyrics/join/{code}", headers=headers_b)
+
+        # User A creates a repertoire
+        rep_res = self.client.post("/lyrics/repertorios", json={
+            "name": "Rep Admin", "group_id": group_id, "lyrics_ids": []
+        }, headers=headers_a)
+        rep_id = rep_res.json()["id"]
+
+        # User B has perm_crud_repertorios = False by default -> should get 403 on editing
+        edit_res = self.client.put(f"/lyrics/repertorios/{rep_id}", json={
+            "name": "Rep Mod", "group_id": group_id, "lyrics_ids": []
+        }, headers=headers_b)
+        self.assertEqual(edit_res.status_code, 403)
+
+        # Enable perm_crud_repertorios
+        requests_json = {
+            "perm_compartir_pistas": True,
+            "perm_compartir_letras": True,
+            "perm_crud_repertorios": True,  # Enabled!
+            "perm_crud_letras": True,
+            "perm_ver_pistas": True,
+            "perm_ver_letras": True,
+            "perm_ver_repertorios": True,
+            "perm_gestionar_solicitudes": False
+        }
+        self.client.put(f"/alabanza/grupos/{group_id}/miembros/{id_b}/permisos", json=requests_json, headers=headers_a)
+
+        # User B edits -> 200 OK
+        edit_res = self.client.put(f"/lyrics/repertorios/{rep_id}", json={
+            "name": "Rep Mod", "group_id": group_id, "lyrics_ids": []
+        }, headers=headers_b)
+        self.assertEqual(edit_res.status_code, 200)
+
+    def test_repertoire_view_permissions(self):
+        """Test viewing repertoires based on perm_ver_repertorios"""
+        headers_a, id_a = self._create_user_and_token("user_a", "a@example.com")
+        headers_b, id_b = self._create_user_and_token("user_b", "b@example.com")
+
+        # User A creates group
+        g_res = self.client.post("/lyrics/groups", json={"name": "Grupo A"}, headers=headers_a)
+        group_id = g_res.json()["id"]
+
+        # Join B
+        inv_res = self.client.post(f"/lyrics/groups/{group_id}/invite", headers=headers_a)
+        code = inv_res.json()["code"]
+        self.client.post(f"/lyrics/join/{code}", headers=headers_b)
+
+        # User A creates a repertoire
+        rep_res = self.client.post("/lyrics/repertorios", json={
+            "name": "Rep Admin", "group_id": group_id, "lyrics_ids": []
+        }, headers=headers_a)
+        rep_id = rep_res.json()["id"]
+
+        # User B can view by default
+        get_res = self.client.get(f"/lyrics/repertorios/{rep_id}", headers=headers_b)
+        self.assertEqual(get_res.status_code, 200)
+
+        list_res = self.client.get(f"/alabanza/grupos/{group_id}/repertorios", headers=headers_b)
+        self.assertEqual(list_res.status_code, 200)
+
+        # Disable perm_ver_repertorios
+        requests_json = {
+            "perm_compartir_pistas": True,
+            "perm_compartir_letras": True,
+            "perm_crud_repertorios": True,
+            "perm_crud_letras": True,
+            "perm_ver_pistas": True,
+            "perm_ver_letras": True,
+            "perm_ver_repertorios": False,  # Disabled
+            "perm_gestionar_solicitudes": False
+        }
+        self.client.put(f"/alabanza/grupos/{group_id}/miembros/{id_b}/permisos", json=requests_json, headers=headers_a)
+
+        # User B tries to view group repertoires -> 403
+        list_res = self.client.get(f"/alabanza/grupos/{group_id}/repertorios", headers=headers_b)
+        self.assertEqual(list_res.status_code, 403)
+
+        # User B tries to view individual repertoire -> 403
+        get_res = self.client.get(f"/lyrics/repertorios/{rep_id}", headers=headers_b)
+        self.assertEqual(get_res.status_code, 403)
+
+    def test_songs_view_permissions(self):
+        """Test viewing tracks/songs and get_stems/harmony_status based on perm_ver_pistas"""
+        headers_a, id_a = self._create_user_and_token("user_a", "a@example.com")
+        headers_b, id_b = self._create_user_and_token("user_b", "b@example.com")
+
+        # User A creates group
+        g_res = self.client.post("/lyrics/groups", json={"name": "Grupo A"}, headers=headers_a)
+        group_id = g_res.json()["id"]
+
+        # Join B
+        inv_res = self.client.post(f"/lyrics/groups/{group_id}/invite", headers=headers_a)
+        code = inv_res.json()["code"]
+        self.client.post(f"/lyrics/join/{code}", headers=headers_b)
+
+        # Seed a Task in DB directly
+        db = TestingSessionLocal()
+        task = Task(
+            task_id="task_test_123",
+            user_id=id_a,
+            song_name="Song A",
+            status="success",
+            telegram_file_ids='{"vocals": "stems/task_test_123/vocals.flac"}'
+        )
+        db.add(task)
+        db.commit()
+        
+        # Share it
+        db_group = db.query(Group).filter(Group.id == group_id).first()
+        task.groups_shared.append(db_group)
+        db.commit()
+        db.close()
+
+        # User B can view by default
+        get_res = self.client.get("/songs/tasks/task_test_123", headers=headers_b)
+        self.assertEqual(get_res.status_code, 200)
+
+        stems_res = self.client.get("/songs/stems/task_test_123", headers=headers_b)
+        self.assertEqual(stems_res.status_code, 200)
+
+        harm_res = self.client.get("/songs/harmony-status/task_test_123", headers=headers_b)
+        self.assertEqual(harm_res.status_code, 200)
+
+        list_res = self.client.get(f"/alabanza/grupos/{group_id}/pistas", headers=headers_b)
+        self.assertEqual(list_res.status_code, 200)
+
+        # Disable perm_ver_pistas
+        requests_json = {
+            "perm_compartir_pistas": True,
+            "perm_compartir_letras": True,
+            "perm_crud_repertorios": True,
+            "perm_crud_letras": True,
+            "perm_ver_pistas": False,  # Disabled
+            "perm_ver_letras": True,
+            "perm_ver_repertorios": True,
+            "perm_gestionar_solicitudes": False
+        }
+        self.client.put(f"/alabanza/grupos/{group_id}/miembros/{id_b}/permisos", json=requests_json, headers=headers_a)
+
+        # User B tries to view group tracks -> 403
+        list_res = self.client.get(f"/alabanza/grupos/{group_id}/pistas", headers=headers_b)
+        self.assertEqual(list_res.status_code, 403)
+
+        # User B tries to view individual track -> 403
+        get_res = self.client.get("/songs/tasks/task_test_123", headers=headers_b)
+        self.assertEqual(get_res.status_code, 403)
+
+        # User B tries to view stems -> 403
+        stems_res = self.client.get("/songs/stems/task_test_123", headers=headers_b)
+        self.assertEqual(stems_res.status_code, 403)
+
+        # User B tries to check harmony status -> 403
+        harm_res = self.client.get("/songs/harmony-status/task_test_123", headers=headers_b)
+        self.assertEqual(harm_res.status_code, 403)
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/verify_group_permissions.py

@@ -0,0 +1,205 @@
+import requests
+import uuid
+
+BASE_URL = "http://127.0.0.1:8000"
+
+def run_tests():
+    print("=" * 70)
+    print("INICIANDO PRUEBAS DE VERIFICACIÓN DE PERMISOS GRANULARES DE GRUPO")
+    print("=" * 70)
+
+    # 1. Registrar y autenticar usuarios de prueba
+    suffix = str(uuid.uuid4())[:8]
+    user_a = f"admin_perm_{suffix}"
+    user_b = f"member_perm_{suffix}"
+    password = "password123"
+
+    print("\n[1] Registrando y logueando usuarios...")
+    for u in [user_a, user_b]:
+        requests.post(f"{BASE_URL}/auth/register", json={
+            "username": u,
+            "email": f"{u}@example.com",
+            "password": password
+        })
+
+    # Login User A (Admin del grupo)
+    res_a = requests.post(f"{BASE_URL}/auth/token", data={
+        "username": f"{user_a}@example.com",
+        "password": password,
+        "device_id": f"dev_a_{suffix}",
+        "device_name": "Device A"
+    })
+    token_a = res_a.json()["access_token"]
+    headers_a = {"Authorization": f"Bearer {token_a}"}
+
+    # Login User B (Miembro del grupo)
+    res_b = requests.post(f"{BASE_URL}/auth/token", data={
+        "username": f"{user_b}@example.com",
+        "password": password,
+        "device_id": f"dev_b_{suffix}",
+        "device_name": "Device B"
+    })
+    token_b = res_b.json()["access_token"]
+    headers_b = {"Authorization": f"Bearer {token_b}"}
+    member_user_id = res_b.json()["user"]["id"]
+
+    print("   [OK] Usuarios listos.")
+
+    # 2. User A crea un grupo
+    print("\n[2] User A creando grupo...")
+    group_res = requests.post(f"{BASE_URL}/lyrics/groups", json={"name": f"Grupo Perm {suffix}"}, headers=headers_a)
+    group_id = group_res.json()["id"]
+    print(f"   [OK] Grupo creado con ID {group_id}")
+
+    # 3. User B se une al grupo
+    print("\n[3] User B uniéndose...")
+    invite_res = requests.post(f"{BASE_URL}/lyrics/groups/{group_id}/invite", headers=headers_a)
+    code = invite_res.json()["code"]
+    requests.post(f"{BASE_URL}/lyrics/join/{code}", headers=headers_b)
+    print("   [OK] User B unido al grupo.")
+
+    # 4. User A (Admin) crea una letra y una pista (task) de prueba y las comparte con el grupo
+    # Primero creamos letra
+    lyric_res = requests.post(f"{BASE_URL}/lyrics", json={
+        "title": "Letra de Admin",
+        "artist": "Artista Admin",
+        "content": "Contenido de Admin",
+        "group_id": group_id
+    }, headers=headers_a)
+    lyric_id = lyric_res.json()["id"]
+
+    # Simular una pista en DB (para propósitos del test no necesitamos procesarla, pero necesitamos el registro)
+    # Como crear una pista requiere subir archivo o youtube, subiremos un pequeño archivo de prueba o compartiremos uno existente.
+    # En Melodix, el endpoint para crear tarea es `/songs` o `/songs/upload-youtube`.
+    # Vamos a subir una pista de prueba simulada si es posible, o registrarla.
+    # Para no complicar con subida de archivos binarios reales, podemos usar /songs/upload-youtube con un enlace dummy de youtube
+    # Pero eso consume créditos y podría tardar/fallar si no hay internet o celery no corre.
+    # Alternativamente, podemos probar las letras y repertorios primero.
+    # Probemos letras y repertorios.
+
+    # 5. User A crea un repertorio
+    print("\n[4] User A creando repertorio grupal...")
+    rep_res = requests.post(f"{BASE_URL}/lyrics/repertorios", json={
+        "name": "Repertorio de Prueba",
+        "group_id": group_id,
+        "lyrics_ids": [lyric_id]
+    }, headers=headers_a)
+    rep_id = rep_res.json()["id"]
+    print(f"   [OK] Repertorio creado con ID {rep_id}")
+
+    # 6. Probemos permisos por defecto (miembros tienen permisos de lectura habilitados por defecto, pero no CRUD repertorio)
+    print("\n[5] Probando permisos por defecto de User B...")
+    # Ver letras del grupo
+    res = requests.get(f"{BASE_URL}/alabanza/grupos/{group_id}/letras", headers=headers_b)
+    assert res.status_code == 200, f"Error obteniendo letras del grupo: {res.text}"
+    
+    # Ver letra individual
+    res = requests.get(f"{BASE_URL}/lyrics/{lyric_id}", headers=headers_b)
+    assert res.status_code == 200, f"Error obteniendo letra: {res.text}"
+
+    # Ver repertorios del grupo
+    res = requests.get(f"{BASE_URL}/alabanza/grupos/{group_id}/repertorios", headers=headers_b)
+    assert res.status_code == 200, f"Error obteniendo repertorios del grupo: {res.text}"
+
+    # Ver repertorio individual
+    res = requests.get(f"{BASE_URL}/lyrics/repertorios/{rep_id}", headers=headers_b)
+    assert res.status_code == 200, f"Error obteniendo repertorio: {res.text}"
+
+    # Intentar modificar repertorio (esperado 403 por defecto ya que perm_crud_repertorios es False)
+    res = requests.put(f"{BASE_URL}/lyrics/repertorios/{rep_id}", json={
+        "name": "Repertorio Modificado por B",
+        "group_id": group_id,
+        "lyrics_ids": [lyric_id]
+    }, headers=headers_b)
+    assert res.status_code == 403, f"Se esperaba 403 al editar repertorio sin permiso, se obtuvo {res.status_code}"
+    print("   [OK] Restricción de CRUD repertorio por defecto funciona (403).")
+
+    # 7. Cambiar permisos: Habilitar perm_crud_repertorios, deshabilitar perm_ver_letras y perm_ver_repertorios
+    print("\n[6] User A actualiza permisos de User B...")
+    perm_res = requests.put(f"{BASE_URL}/alabanza/grupos/{group_id}/miembros/{member_user_id}/permisos", json={
+        "perm_compartir_pistas": True,
+        "perm_compartir_letras": False,  # Deshabilitado
+        "perm_crud_repertorios": True,   # Habilitado
+        "perm_crud_letras": True,
+        "perm_ver_pistas": True,
+        "perm_ver_letras": False,        # Deshabilitado
+        "perm_ver_repertorios": False,   # Deshabilitado
+        "perm_gestionar_solicitudes": False
+    }, headers=headers_a)
+    assert perm_res.status_code == 200, f"Error actualizando permisos: {perm_res.text}"
+    print("   [OK] Permisos actualizados en el servidor.")
+
+    # 8. Validar que deshabilitar perm_ver_letras y perm_ver_repertorios funcione
+    print("\n[7] Probando permisos de visualización deshabilitados para User B...")
+    # Obtener letras del grupo (esperado 403)
+    res = requests.get(f"{BASE_URL}/alabanza/grupos/{group_id}/letras", headers=headers_b)
+    assert res.status_code == 403, f"Se esperaba 403 al listar letras, se obtuvo {res.status_code}"
+    
+    # Obtener letra individual (esperado 403)
+    res = requests.get(f"{BASE_URL}/lyrics/{lyric_id}", headers=headers_b)
+    assert res.status_code == 403, f"Se esperaba 403 al obtener letra, se obtuvo {res.status_code}"
+
+    # Obtener repertorios del grupo (esperado 403)
+    res = requests.get(f"{BASE_URL}/alabanza/grupos/{group_id}/repertorios", headers=headers_b)
+    assert res.status_code == 403, f"Se esperaba 403 al listar repertorios, se obtuvo {res.status_code}"
+
+    # Obtener repertorio individual (esperado 403)
+    res = requests.get(f"{BASE_URL}/lyrics/repertorios/{rep_id}", headers=headers_b)
+    assert res.status_code == 403, f"Se esperaba 403 al obtener repertorio, se obtuvo {res.status_code}"
+    print("   [OK] Restricciones de visualización funcionan (403).")
+
+    # 9. Validar que perm_crud_repertorios habilitado funcione
+    print("\n[8] Probando perm_crud_repertorios habilitado para User B...")
+    res = requests.put(f"{BASE_URL}/lyrics/repertorios/{rep_id}", json={
+        "name": "Repertorio Modificado por B con Permiso",
+        "group_id": group_id,
+        "lyrics_ids": [lyric_id]
+    }, headers=headers_b)
+    assert res.status_code == 200, f"Error al editar repertorio teniendo permiso: {res.text}"
+    print("   [OK] Edición de repertorio por miembro autorizado exitosa.")
+
+    # 10. Validar compartir letra con perm_compartir_letras deshabilitado
+    # Primero creamos una letra propia de User B (que no está compartida con el grupo aún)
+    lyric_b_res = requests.post(f"{BASE_URL}/lyrics", json={
+        "title": "Letra de B",
+        "artist": "Artista B",
+        "content": "Contenido de B",
+        "group_id": None
+    }, headers=headers_b)
+    lyric_b_id = lyric_b_res.json()["id"]
+
+    print("\n[9] Probando compartir letra con perm_compartir_letras deshabilitado...")
+    res = requests.post(f"{BASE_URL}/lyrics/{lyric_b_id}/share", json={
+        "group_id": group_id,
+        "action": "share"
+    }, headers=headers_b)
+    assert res.status_code == 403, f"Se esperaba 403 al compartir letra sin permiso, se obtuvo {res.status_code}"
+    print("   [OK] Compartir letra bloqueado correctamente (403).")
+
+    # Habilitar perm_compartir_letras y volver a intentar
+    print("\n[10] User A habilita perm_compartir_letras a User B...")
+    perm_res = requests.put(f"{BASE_URL}/alabanza/grupos/{group_id}/miembros/{member_user_id}/permisos", json={
+        "perm_compartir_pistas": True,
+        "perm_compartir_letras": True,   # Habilitado ahora
+        "perm_crud_repertorios": True,
+        "perm_crud_letras": True,
+        "perm_ver_pistas": True,
+        "perm_ver_letras": True,
+        "perm_ver_repertorios": True,
+        "perm_gestionar_solicitudes": False
+    }, headers=headers_a)
+    
+    print("Intentando compartir letra con permiso habilitado...")
+    res = requests.post(f"{BASE_URL}/lyrics/{lyric_b_id}/share", json={
+        "group_id": group_id,
+        "action": "share"
+    }, headers=headers_b)
+    assert res.status_code == 200, f"Error al compartir letra teniendo permiso: {res.text}"
+    print("   [OK] Compartir letra por miembro autorizado exitosa.")
+
+    print("\n" + "=" * 70)
+    print("  ¡TODAS LAS PRUEBAS DE PERMISOS DE GRUPO PASARON CON EXITO!")
+    print("=" * 70 + "\n")
+
+if __name__ == "__main__":
+    run_tests()