Browse Source

HUE-3421 [doc2] Restrict re-sharing to the given user's permission level

Jenny Kim 9 years ago
parent
commit
eb11e9e
2 changed files with 44 additions and 1 deletions
  1. 8 1
      desktop/core/src/desktop/models.py
  2. 36 0
      desktop/core/src/desktop/tests_doc2.py

+ 8 - 1
desktop/core/src/desktop/models.py

@@ -1125,7 +1125,14 @@ class Document2(models.Model):
     return self
 
   def update_permission(self, user, name='read', users=None, groups=None):
-    # TODO check in settings if user can sync, re-share, which perms...
+    # Check if user has access to grant permissions
+    if users or groups:
+      if name == 'read':
+        self.can_read_or_exception(user)
+      elif name == 'write':
+        self.can_write_or_exception(user)
+      else:
+        raise ValueError(_('Invalid permission type: %s') % name)
 
     perm, created = Document2Permission.objects.get_or_create(doc=self, perms=name)
 

+ 36 - 0
desktop/core/src/desktop/tests_doc2.py

@@ -438,6 +438,42 @@ class TestDocument2Permissions(object):
     data = json.loads(response.content)
     assert_equal(doc.uuid, data['document']['uuid'], data)
 
+    # other user can share document with read permissions
+    response = self.client_not_me.post("/desktop/api2/doc/share", {
+      'uuid': json.dumps(doc.uuid),
+      'data': json.dumps({
+        'read': {
+          'user_ids': [],
+          'group_ids': [
+            self.default_group.id
+          ],
+        },
+        'write': {
+          'user_ids': [],
+          'group_ids': [],
+        }
+      })
+    })
+    assert_equal(0, json.loads(response.content)['status'], response.content)
+
+    # other user cannot share document with write permissions
+    response = self.client_not_me.post("/desktop/api2/doc/share", {
+      'uuid': json.dumps(doc.uuid),
+      'data': json.dumps({
+        'read': {
+          'user_ids': [],
+          'group_ids': [],
+        },
+        'write': {
+          'user_ids': [],
+          'group_ids': [
+            self.default_group.id
+          ],
+        }
+      })
+    })
+    assert_equal(-1, json.loads(response.content)['status'], response.content)
+
 
   def test_share_document_read_by_group(self):
     doc = Document2.objects.create(name='new_doc', type='query-hive', owner=self.user, data={}, parent_directory=self.home_dir)