sartography
/
spiff-arena
mirror of https://github.com/sartography/spiff-arena.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

check if user has access to full process models or groups before checking each one w/ burnettk

This commit is contained in:
jasquat 2023-05-05 16:27:31 -04:00
parent 1b97cbb5b2
commit 11952aaaa7
1 changed files with 16 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
spiffworkflow-backend/src/spiffworkflow_backend/services/process_model_service.py
View File

@ -216,11 +216,18 @@ class ProcessModelService(FileSystemService):
permission_to_check = "read" permission_to_check = "read"
permission_base_uri = "/v1.0/process-models" permission_base_uri = "/v1.0/process-models"
user = UserService.current_user()
if filter_runnable_by_user: if filter_runnable_by_user:
permission_to_check = "create" permission_to_check = "create"
permission_base_uri = "/v1.0/process-instances" permission_base_uri = "/v1.0/process-instances"
user = UserService.current_user() # if user has access to uri/* with that permission then there's no reason to check each one individually
has_permission = AuthorizationService.user_has_permission(
user=user, permission=permission_to_check, target_uri=f"{permission_base_uri}/%"
)
if has_permission:
return process_models
new_process_model_list = [] new_process_model_list = []
for process_model in process_models: for process_model in process_models:
modified_process_model_id = ProcessModelInfo.modify_process_identifier_for_path_param(process_model.id) modified_process_model_id = ProcessModelInfo.modify_process_identifier_for_path_param(process_model.id)
@ -276,8 +283,15 @@ class ProcessModelService(FileSystemService):
permission_to_check = "read" permission_to_check = "read"
permission_base_uri = "/v1.0/process-groups" permission_base_uri = "/v1.0/process-groups"
user = UserService.current_user() user = UserService.current_user()
# if user has access to uri/* with that permission then there's no reason to check each one individually
has_permission = AuthorizationService.user_has_permission(
user=user, permission=permission_to_check, target_uri=f"{permission_base_uri}/%"
)
if has_permission:
return process_groups
new_process_group_list = [] new_process_group_list = []
for process_group in process_groups: for process_group in process_groups:
modified_process_group_id = ProcessModelInfo.modify_process_identifier_for_path_param(process_group.id) modified_process_group_id = ProcessModelInfo.modify_process_identifier_for_path_param(process_group.id)