Commit c897ebe7 authored by Mickaël Desfrênes's avatar Mickaël Desfrênes
Browse files

start checking permissions

parent 41863f82

rpc/methods.py

+41 −1
Original line number Diff line number Diff line
@@ -9,6 +9,8 @@ from resources.models import ( 
    MetadataResourceValue,

    MetadataCollectionValue,

    Tag,

    Project,

    ProjectAccess,

    APIKey,

)

from django.contrib.auth.models import User
@@ -26,6 +28,15 @@ class ServiceException(Exception): 
    pass





def _check_project_permission(user: User, project: Project, right: str) -> bool:

    access = ProjectAccess.objects.filter(

        user=user, project=project, role__permissions__label=right

    ).first()

    if access:

        return True

    raise ServiceException("No access ({})".format(right))





# Define RPC functions here.

# ALL RPC functions receive a User instance as first argument
@@ -47,6 +58,31 @@ def ping(user: User) -> str: 
ping.rpc_groups = ["Utilities"]





def projects_permissions(user: User) -> List[Dict]:

    """

    Get all rights for the current user.



    Example output:



    ```

    [

        {

            'project': {'id': 7, 'label': 'john doe main project'},

            'role': {'id': 7, 'label': 'admin', 'permissions': [{"id": 1, "label": "do_anything"}]},

            'user': 'john doe'

        }

    ]

    ```

    """

    access_list = []

    for project_access in ProjectAccess.objects.filter(user=user):

        access_list.append(serializers.project_access(project_access))

    return access_list





projects_permissions.rpc_groups = ["Utilities"]





def metadatasets(user: User) -> List[Dict]:

    """

    Get the list of all the user's metadata sets.
@@ -408,6 +444,7 @@ def delete_metadata(user: User, metadata_id: int) -> bool: 
    """

    try:

        metadata_instance = Metadata.objects.get(owner=user, pk=metadata_id)

        _check_project_permission(user, metadata_instance.project, "metadata.delete")

        metadata_instance.delete()

        return True

    except Metadata.DoesNotExist:
@@ -466,7 +503,7 @@ def delete_collection(user: User, collection_id: int, recursive: bool = False) - 
    collection_instance = query_set.first()

    if not collection_instance:

        return {"success": True, "status": "does not exist"}



    _check_project_permission(user, collection_instance.project, "collection.delete")

    if recursive:

        for resource_instance in collection_instance.resources.all():

            if resource_instance.ptr_owner == user:
@@ -500,6 +537,7 @@ def rename_collection(user: User, collection_id: int, title: str) -> bool: 
    collection_instance = query_set.first()

    if not collection_instance:

        return False

    _check_project_permission(user, collection_instance.project, "collection.rename")

    collection_instance.title = title

    collection_instance.save()

    return True
@@ -518,6 +556,7 @@ def rename_resource(user: User, resource_id: int, title: str) -> bool: 
    resource_instance = query_set.first()

    if not resource_instance:

        return False

    _check_project_permission(user, resource_instance.project, "resource.rename")

    resource_instance.title = title

    resource_instance.save()

    return True
@@ -536,6 +575,7 @@ def rename_meta(user: User, meta_id: int, title: str) -> bool: 
    meta_instance = query_set.first()

    if not meta_instance:

        return False

    _check_project_permission(user, meta_instance.project, "metadata.rename")

    meta_instance.title = title

    meta_instance.save()

    return True

rpc/serializers.py

+23 −0
Original line number Diff line number Diff line
@@ -179,3 +179,26 @@ def tag(tag_instance: models.Tag) -> dict: 


def project(project_instance: models.Project) -> dict:

    return {"id": project_instance.pk, "label": project_instance.label}





def permission(permission_instance: models.Permission) -> dict:

    return {"id": permission_instance.pk, "label": permission_instance.label}





def role(role_instance: models.Role) -> dict:

    permissions = []

    for permission_instance in role_instance.permissions.all():

        permissions.append(permission(permission_instance))

    return {

        "id": role_instance.id,

        "label": role_instance.label,

        "permissions": permissions,

    }





def project_access(project_access_instance: models.ProjectAccess) -> dict:

    return {

        "project": project(project_access_instance.project),

        "role": role(project_access_instance.role),

        "user": project_access_instance.user.username,

    }