Merge pull request #863 from MerginMaps/auth_db_check_role

Check role first

Author: MarcelGeo

Mergin/utils_auth.py

@@ -620,18 +620,19 @@ def get_auth_config_hash(self, auth_ids: typing.List[str]) -> str:
     def export_auth(self, client) -> None:
         """Export auth DB credentials for protected layers if they have changed"""
 
+        # permission check - auth config .xml file can be modified from the writer role above
+        project_info = client.project_info(self.mp.project_full_name())
+        role = project_info.get("role")
+        if not (role and role in ("writer", "owner")):
+            return
+
         referenced_ids = self.get_layers_auth_ids()
         available_ids = self.auth_mngr.configIds()
         auth_ids = [aid for aid in referenced_ids if aid in available_ids]
-
         if not auth_ids:
             if os.path.exists(self.auth_file):
                 os.remove(self.auth_file)
             return
-        project_info = client.project_info(self.mp.project_full_name())
-        role = project_info.get("role")
-        if not (role and role in ("writer", "owner")):
-            return
 
         if not self.auth_mngr.masterPasswordIsSet():
             self.mp.log.warning("Master Password not set. Cannot export auth configs.")