From c7b8b0373a171e114213fa0f5337ac571ea19e3c Mon Sep 17 00:00:00 2001
From: Tom Hacohen <tom@stosb.com>
Date: Sun, 27 Dec 2020 22:56:23 +0200
Subject: [PATCH] Add permissions.

---
 etebase_fastapi/collection.py | 28 ++++++++++++++++++++++++----
 etebase_fastapi/member.py     | 23 ++++++++++++++++++-----
 2 files changed, 42 insertions(+), 9 deletions(-)

diff --git a/etebase_fastapi/collection.py b/etebase_fastapi/collection.py
index 196bb1d..13c53be 100644
--- a/etebase_fastapi/collection.py
+++ b/etebase_fastapi/collection.py
@@ -12,10 +12,10 @@ from pydantic import BaseModel
 
 from django_etebase import models
 from .authentication import get_authenticated_user
-from .exceptions import ValidationError, transform_validation_error
+from .exceptions import ValidationError, transform_validation_error, PermissionDenied
 from .msgpack import MsgpackRoute, MsgpackResponse
 from .stoken_handler import filter_by_stoken_and_limit, filter_by_stoken, get_stoken_obj, get_queryset_stoken
-from .utils import get_object_or_404, Context, Prefetch, PrefetchQuery
+from .utils import get_object_or_404, Context, Prefetch, PrefetchQuery, is_collection_admin
 
 User = get_user_model()
 collection_router = APIRouter(route_class=MsgpackRoute)
@@ -209,6 +209,26 @@ def get_item_queryset(collection: models.Collection = Depends(get_collection)) -
     return queryset
 
 
+# permissions
+
+
+def verify_collection_admin(
+    collection: models.Collection = Depends(get_collection), user: User = Depends(get_authenticated_user)
+):
+    if not is_collection_admin(collection, user):
+        raise PermissionDenied("admin_access_required", "Only collection admins can perform this operation.")
+
+
+def has_write_access(
+    collection: models.Collection = Depends(get_collection), user: User = Depends(get_authenticated_user)
+):
+    member = collection.members.get(user=user)
+    if member.accessLevel == models.AccessLevels.READ_ONLY:
+        raise PermissionDenied("no_write_access", "You need write access to write to this collection")
+
+
+# paths
+
 @collection_router.post("/list_multi/")
 async def list_multi(
     data: ListMulti,
@@ -489,14 +509,14 @@ def fetch_updates(
     return MsgpackResponse(ret)
 
 
-@collection_router.post("/{collection_uid}/item/transaction/")
+@collection_router.post("/{collection_uid}/item/transaction/", dependencies=[Depends(has_write_access)])
 def item_transaction(
     collection_uid: str, data: ItemBatchIn, stoken: t.Optional[str] = None, user: User = Depends(get_authenticated_user)
 ):
     return item_bulk_common(data, user, stoken, collection_uid, validate_etag=True)
 
 
-@collection_router.post("/{collection_uid}/item/batch/")
+@collection_router.post("/{collection_uid}/item/batch/", dependencies=[Depends(has_write_access)])
 def item_batch(
     collection_uid: str, data: ItemBatchIn, stoken: t.Optional[str] = None, user: User = Depends(get_authenticated_user)
 ):
diff --git a/etebase_fastapi/member.py b/etebase_fastapi/member.py
index a491490..f3c77e5 100644
--- a/etebase_fastapi/member.py
+++ b/etebase_fastapi/member.py
@@ -12,7 +12,7 @@ from .msgpack import MsgpackResponse
 from .utils import get_object_or_404
 from .stoken_handler import filter_by_stoken_and_limit
 
-from .collection import collection_router, get_collection
+from .collection import collection_router, get_collection, verify_collection_admin
 
 User = get_user_model()
 default_queryset: QuerySet = models.CollectionMember.objects.all()
@@ -48,7 +48,9 @@ class MemberListResponse(BaseModel):
     done: bool
 
 
-@collection_router.get("/{collection_uid}/member/", response_model=MemberListResponse)
+@collection_router.get(
+    "/{collection_uid}/member/", response_model=MemberListResponse, dependencies=[Depends(verify_collection_admin)]
+)
 def member_list(
     iterator: t.Optional[str] = None,
     limit: int = 50,
@@ -68,14 +70,22 @@ def member_list(
     return MsgpackResponse(ret)
 
 
-@collection_router.delete("/{collection_uid}/member/{username}/", status_code=status.HTTP_204_NO_CONTENT)
+@collection_router.delete(
+    "/{collection_uid}/member/{username}/",
+    status_code=status.HTTP_204_NO_CONTENT,
+    dependencies=[Depends(verify_collection_admin)],
+)
 def member_delete(
     obj: models.CollectionMember = Depends(get_member),
 ):
     obj.revoke()
 
 
-@collection_router.patch("/{collection_uid}/member/{username}/", status_code=status.HTTP_204_NO_CONTENT)
+@collection_router.patch(
+    "/{collection_uid}/member/{username}/",
+    status_code=status.HTTP_204_NO_CONTENT,
+    dependencies=[Depends(verify_collection_admin)],
+)
 def member_patch(
     data: CollectionMemberModifyAccessLevelIn,
     instance: models.CollectionMember = Depends(get_member),
@@ -88,7 +98,10 @@ def member_patch(
             instance.save()
 
 
-@collection_router.post("/{collection_uid}/member/leave/", status_code=status.HTTP_204_NO_CONTENT)
+@collection_router.post(
+    "/{collection_uid}/member/leave/",
+    status_code=status.HTTP_204_NO_CONTENT,
+)
 def member_leave(user: User = Depends(get_authenticated_user), collection: models.Collection = Depends(get_collection)):
     obj = get_object_or_404(collection.members, user=user)
     obj.revoke()