check permissions for collections (bbf7d3bf) · Commits · certic / Jama

rpc/methods.py

+35 −13

Original line number	Diff line number	Diff line
		@@ -109,8 +109,8 @@ def metadatasets(user: User, project_id: int) -> List[Dict]:

		```
		[
		{"id": 1, "title": "exif metas", "owner": "john", "metas_count": 23},
		{"id": 2, "title": "dublin core", "owner": "john", "metas_count": 17}
		{"id": 1, "title": "exif metas", "project_id": 1, "metas_count": 23},
		{"id": 2, "title": "dublin core", "project_id": 1, "metas_count": 17}
		]
		```
		"""
		@@ -148,7 +148,7 @@ def metadatas(user: User, metadata_set_id: int) -> List[Dict]:
		"set_id": 1,
		"set_title": "exif metas",
		"rank": 0,
		"owner": "john",
		"project_id": 1,
		},
		{
		"id": 2,
		@@ -156,7 +156,7 @@ def metadatas(user: User, metadata_set_id: int) -> List[Dict]:
		"set_id": 1,
		"set_title": "exif metas",
		"rank": 1,
		"owner": "john",
		"project_id": 1,
		}
		]
		```
		@@ -190,7 +190,7 @@ def metadata(user: User, metadata_id: int) -> Union[Dict, None]:
		"set_id": 1,
		"set_title": "exif metas",
		"rank": 1,
		"owner": "john",
		"project_id": 1,
		}
		```
		"""
		@@ -224,7 +224,7 @@ def collections(
		collections available at root. If 'recursive' is true, will
		return all the descendants recursively in the 'children' key.
		If recursive is false, 'children' is null. If flat_list is True,
		collections are returned as a flat list and parent is not used.
		collections are returned as a flat list and parent_id is ignored.

		Example output:

		@@ -246,12 +246,17 @@ def collections(
		]
		```
		"""
		if not parent_id and not project_id:
		raise ServiceException("project_id is needed when parent_is is null")
		try:
		if parent_id is None:
		parent = Collection.objects.get(title="root", parent_id=None)
		else:
		parent = Collection.objects.get(
		pk=parent_id, owner=user, deleted_at__isnull=True
		pk=parent_id,
		deleted_at__isnull=True,
		project__projectaccess__user=user,
		project__project_access__role__permission__label="collection.read",
		)
		except Collection.DoesNotExist:
		raise ServiceException("no such collection")
		@@ -262,11 +267,18 @@ def collections(
		data = []
		if flat_list:
		query_set: Union[Iterator[Collection], QuerySet] = Collection.objects.filter(
		owner=user, deleted_at__isnull=True
		project=parent.project,
		deleted_at__isnull=True,
		project__projectaccess__user=user,
		project__project_access__role__permission__label="collection.read",
		).order_by("pk")
		else:
		query_set: Union[Iterator[Collection], QuerySet] = Collection.objects.filter(
		owner=user, parent=parent, deleted_at__isnull=True
		parent=parent,
		deleted_at__isnull=True,
		project=parent.project,
		project__projectaccess__user=user,
		project__project_access__role__permission__label="collection.read",
		)
		if only_published:
		query_set = query_set.filter(public_access=True)
		@@ -279,7 +291,9 @@ def collections(
		collections.rpc_groups = ["Collections"]


		def collection(user: User, collection_id: int = None) -> Union[Dict, None]:
		def collection(
		user: User, collection_id: int = None, project_id: int = None
		) -> Union[Dict, None]:
		"""
		Get a particular collection given its id.

		@@ -301,7 +315,8 @@ def collection(user: User, collection_id: int = None) -> Union[Dict, None]:
		}
		```

		if collection id is null, will only return the number of collections at root:
		if collection id is null, will only return the number of collections at root
		for the given project_id:

		```
		{
		@@ -311,6 +326,8 @@ def collection(user: User, collection_id: int = None) -> Union[Dict, None]:
		}
		```
		"""
		if not collection_id and not project_id:
		raise ServiceException("must give one of collection_id or project_id")
		# Special case, fast count of children collections if root.
		# No other key to speed up.
		if not collection_id:
		@@ -319,16 +336,21 @@ def collection(user: User, collection_id: int = None) -> Union[Dict, None]:
		"id": None,
		"title": "root",
		"children_count": Collection.objects.filter(
		parent=parent, owner=user
		parent=parent,
		deleted_at__isnull=True,
		project_id=project_id,
		project__projectaccess__user=user,
		project__project_access__role__permission__label="collection.read",
		).count(),
		}
		return data
		query_set: Union[Iterator[Collection], QuerySet] = Collection.objects.filter(
		pk=collection_id, owner=user, deleted_at__isnull=True
		pk=collection_id, deleted_at__isnull=True
		)
		collection_instance = query_set.first()
		if not collection_instance:
		return None
		_check_project_permission(user, collection_instance.project, "collection.read")
		return serializers.collection(collection_instance)

rpc/serializers.py

+2 −2

Original line number	Diff line number	Diff line
		@@ -25,7 +25,7 @@ def metadataset(metadataset_instance: models.MetadataSet) -> dict:
		return {
		"id": metadataset_instance.id,
		"title": metadataset_instance.title,
		"owner": metadataset_instance.owner.username,
		"project_id": metadataset_instance.project.id,
		"metas_count": metadataset_instance.metadata_set.filter(expose=True).count(),
		}

		@@ -37,7 +37,7 @@ def metadata(metadata_instance: models.Metadata) -> dict:
		"set_id": metadata_instance.set.id if metadata_instance.set else None,
		"set_title": metadata_instance.set.title,
		"rank": metadata_instance.rank,
		"owner": metadata_instance.owner.username,
		"project_id": metadata_instance.project.id,
		}