fix is_approved/public auth for projects

Author: tschaume

mpcontribs-api/mpcontribs/api/core.py

@@ -475,18 +475,12 @@ def is_external(self, request):
             "X-Forwarded-Host"
         ) is not None and not request.headers.get("Origin")
 
-    def is_admin(self, groups):
+    def is_admin(self, request):
+        groups = self.get_groups(request)
         admin_group = os.environ.get("ADMIN_GROUP", "admin")
         return admin_group in groups
 
-    def is_admin_or_project_user(self, request, obj):
-        if self.is_anonymous(request):
-            return False
-
-        groups = self.get_groups(request)
-        if self.is_admin(groups):
-            return True
-
+    def is_project_user(self, request, obj):
         if hasattr(obj, "owner"):
             owner = obj.owner
             project = obj.name
@@ -496,9 +490,19 @@ def is_admin_or_project_user(self, request, obj):
         else:
             raise Unauthorized(f"Unable to authorize {obj}")
 
+        groups = self.get_groups(request)
         username = request.headers.get("X-Consumer-Username")
         return project in groups or owner == username
 
+    def is_admin_or_project_user(self, request, obj):
+        if self.is_anonymous(request):
+            return False
+
+        if self.is_admin(request):
+            return True
+
+        return self.is_project_user(request, obj)
+
     def get_projects(self):
         # project is LazyReferenceFields (multiple queries)
         module = import_module("mpcontribs.api.projects.document")
@@ -530,10 +534,10 @@ def get_projects_filter(self, username, groups, filter_names=None):
         return qfilter
 
     def has_read_permission(self, request, qs):
-        groups = self.get_groups(request)
-        if self.is_admin(groups):
+        if self.is_admin(request):
             return qs  # admins can read all entries
 
+        groups = self.get_groups(request)
         is_anonymous = self.is_anonymous(request)
         is_external = self.is_external(request)
         username = request.headers.get("X-Consumer-Username")

mpcontribs-api/mpcontribs/api/projects/views.py

@@ -87,34 +87,43 @@ class ProjectsView(SwaggerView):
     resource = ProjectsResource
     methods = [Fetch, Create, Delete, Update, BulkFetch]
 
-    def has_add_permission(self, req, obj):
-        if self.is_anonymous(req):
+    def has_add_permission(self, request, obj):
+        if self.is_anonymous(request):
             return False
 
-        obj.owner = req.headers.get("X-Consumer-Username")
-        groups = self.get_groups(req)
-        is_admin = self.is_admin(groups)
-        if is_admin:
+        obj.owner = request.headers.get("X-Consumer-Username")
+        if self.is_admin(request):
             return True
 
-        # is_approved can only be set by an admin
-        if obj.is_approved:
-            raise Unauthorized("Only admins can set `is_approved=True`")
+        data = request.json
+        if "is_approved" in data or "is_public" in data:
+            raise Unauthorized("Projects cannot be approved or published on creation.")
 
-        # limit the number of projects a user can own (unless admin)
+        # limit the number of projects a user can own
         nr_projects = Projects.objects(owner=obj.owner).count()
         if nr_projects > MAX_PROJECTS:
             raise Unauthorized(f"{obj.owner} already owns {nr_projects} projects.")
 
         return True
 
-    def has_change_permission(self, req, obj):
-        if not self.is_admin_or_project_user(req, obj):
+    def has_change_permission(self, request, obj):
+        if self.is_anonymous(request):
             return False
 
-        # is_public can only be changed if project is_approved
-        if obj.is_public and not obj.is_approved:
-            raise Unauthorized(f"{obj.id} is not approved yet.")
+        if self.is_admin(request):
+            return True
+
+        if not self.is_project_user(request, obj):
+            raise Unauthorized(
+                "Only project owners and collaborators can edit projects."
+            )
+
+        update = request.json
+        if "is_approved" in update:
+            raise Unauthorized("Only admins can (un)approve projects.")
+
+        if "is_public" in update and not obj.is_approved:
+            raise Unauthorized("Projects can only be published after admin approval.")
 
         return True