globuzma/canaille-globuzma
1
0
Fork 0
forked from Github-Mirrors/canaille
Code Pull requests Activity

refactor: assume ACL have default values

Browse source
This commit is contained in:
Éloi Rivard 2024-03-30 17:15:45 +01:00
parent f2dbda8c89
commit efe3a3c4c4
No known key found for this signature in database
GPG key ID: 7EDA204EA57DD184
4 changed files with 15 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
canaille/backends/ldap/models.py
View file

@ -175,13 +175,13 @@ class User(canaille.core.models.User, LDAPObject):
self.write = set() self.write = set()
for access_group_name, details in current_app.config["CANAILLE"]["ACL"].items(): for access_group_name, details in current_app.config["CANAILLE"]["ACL"].items():
filter_ = self.acl_filter_to_ldap_filter(details.get("FILTER")) filter_ = self.acl_filter_to_ldap_filter(details["FILTER"])
if not filter_ or ( if not filter_ or (
self.id and conn.search_s(self.id, ldap.SCOPE_SUBTREE, filter_) self.id and conn.search_s(self.id, ldap.SCOPE_SUBTREE, filter_)
): ):
self.permissions |= set(details.get("PERMISSIONS", [])) self.permissions |= set(details["PERMISSIONS"])
self.read |= set(details.get("READ", [])) self.read |= set(details["READ"])
self.write |= set(details.get("WRITE", [])) self.write |= set(details["WRITE"])
class Group(canaille.core.models.Group, LDAPObject): class Group(canaille.core.models.Group, LDAPObject):

8
canaille/backends/memory/models.py
View file

@ -241,10 +241,10 @@ class User(canaille.core.models.User, MemoryModel):
self.read = set() self.read = set()
self.write = set() self.write = set()
for access_group_name, details in current_app.config["CANAILLE"]["ACL"].items(): for access_group_name, details in current_app.config["CANAILLE"]["ACL"].items():
if self.match_filter(details.get("FILTER")): if self.match_filter(details["FILTER"]):
self.permissions |= set(details.get("PERMISSIONS", [])) self.permissions |= set(details["PERMISSIONS"])
self.read |= set(details.get("READ", [])) self.read |= set(details["READ"])
self.write |= set(details.get("WRITE", [])) self.write |= set(details["WRITE"])
def match_filter(self, filter): def match_filter(self, filter):
if filter is None: if filter is None:

8
canaille/backends/sql/models.py
View file

@ -180,10 +180,10 @@ class User(canaille.core.models.User, Base, SqlAlchemyModel):
self.read = set() self.read = set()
self.write = set() self.write = set()
for access_group_name, details in current_app.config["CANAILLE"]["ACL"].items(): for access_group_name, details in current_app.config["CANAILLE"]["ACL"].items():
if self.match_filter(details.get("FILTER")): if self.match_filter(details["FILTER"]):
self.permissions |= set(details.get("PERMISSIONS", [])) self.permissions |= set(details["PERMISSIONS"])
self.read |= set(details.get("READ", [])) self.read |= set(details["READ"])
self.write |= set(details.get("WRITE", [])) self.write |= set(details["WRITE"])
def normalize_filter_value(self, attribute, value): def normalize_filter_value(self, attribute, value):
# not super generic, but we can improve this when we have # not super generic, but we can improve this when we have

3
tests/core/test_profile_edition.py
View file

@ -207,6 +207,7 @@ def test_field_permissions_none(testclient, logged_user):
"READ": ["user_name"], "READ": ["user_name"],
"WRITE": [], "WRITE": [],
"PERMISSIONS": ["edit_self"], "PERMISSIONS": ["edit_self"],
"FILTER": None,
} }
g.user.reload() g.user.reload()
@ -235,6 +236,7 @@ def test_field_permissions_read(testclient, logged_user):
"READ": ["user_name", "phone_numbers"], "READ": ["user_name", "phone_numbers"],
"WRITE": [], "WRITE": [],
"PERMISSIONS": ["edit_self"], "PERMISSIONS": ["edit_self"],
"FILTER": None,
} }
g.user.reload() g.user.reload()
res = testclient.get("/profile/user", status=200) res = testclient.get("/profile/user", status=200)
@ -262,6 +264,7 @@ def test_field_permissions_write(testclient, logged_user):
"READ": ["user_name"], "READ": ["user_name"],
"WRITE": ["phone_numbers"], "WRITE": ["phone_numbers"],
"PERMISSIONS": ["edit_self"], "PERMISSIONS": ["edit_self"],
"FILTER": None,
} }
g.user.reload() g.user.reload()
res = testclient.get("/profile/user", status=200) res = testclient.get("/profile/user", status=200)