can_write predicate

pboard/pboard/controllers/api.py

@@ -24,6 +24,7 @@ from pboard.lib.base import BaseController
 from pboard.lib   import dbapi as pld
 from pboard.model import data as pmd
 from pboard import model as pm
+from pboard.lib.auth import can_read, can_write
 
 __all__ = ['PODPublicApiController', 'PODApiController']
 
@@ -127,6 +128,7 @@ class PODApiController(BaseController):
       redirect(lurl('/document/%i'%(loNewNode.parent_id)))
 
     @expose()
+    @require(can_read())
     def get_file_content(self, node_id=None, **kw):
       if node_id==None:
         return
@@ -163,6 +165,7 @@ class PODApiController(BaseController):
         return loResultBuffer.getvalue()
 
     @expose()
+    @require(can_write())
     def set_parent_node(self, node_id, new_parent_id, **kw):
       loCurrentUser   = pld.PODStaticController.getCurrentUser()
       loApiController = pld.PODUserFilteredApiController(loCurrentUser.user_id)
@@ -175,6 +178,7 @@ class PODApiController(BaseController):
       redirect(lurl('/document/%s'%(node_id)))
 
     @expose()
+    @require(can_write())
     def move_node_upper(self, node_id=0):
       loCurrentUser   = pld.PODStaticController.getCurrentUser()
       loApiController = pld.PODUserFilteredApiController(loCurrentUser.user_id)
@@ -185,6 +189,7 @@ class PODApiController(BaseController):
       redirect(lurl('/document/%s'%(node_id)))
 
     @expose()
+    @require(can_write())
     def move_node_lower(self, node_id=0):
       loCurrentUser   = pld.PODStaticController.getCurrentUser()
       loApiController = pld.PODUserFilteredApiController(loCurrentUser.user_id)
@@ -220,6 +225,7 @@ class PODApiController(BaseController):
       redirect(lurl('/document/%i'%(loNewNode.node_id)))
 
     @expose()
+    @require(can_write())
     def edit_status(self, node_id, node_status):
       loCurrentUser   = pld.PODStaticController.getCurrentUser()
       loApiController = pld.PODUserFilteredApiController(loCurrentUser.user_id)
@@ -229,6 +235,7 @@ class PODApiController(BaseController):
       redirect(lurl('/document/%s'%(node_id)))
 
     @expose()
+    @require(can_write())
     def edit_label_and_content(self, node_id, data_label, data_content):
       loCurrentUser   = pld.PODStaticController.getCurrentUser()
       loApiController = pld.PODUserFilteredApiController(loCurrentUser.user_id)
@@ -239,6 +246,7 @@ class PODApiController(BaseController):
       redirect(lurl('/document/%s'%(node_id)))
 
     @expose()
+    @require(can_write())
     def force_delete_node(self, node_id=None):
       loCurrentUser   = pld.PODStaticController.getCurrentUser()
       loApiController = pld.PODUserFilteredApiController(loCurrentUser.user_id)
@@ -270,6 +278,7 @@ class PODApiController(BaseController):
       redirect(lurl('/document/%s'%(back_to_node_id)))
 
     @expose()
+    @require(can_write())
     def toggle_share_status(self, node_id):
       loCurrentUser   = pld.PODStaticController.getCurrentUser()
       loApiController = pld.PODUserFilteredApiController(loCurrentUser.user_id)

pboard/pboard/lib/auth.py

@@ -22,3 +22,22 @@ class can_read(Predicate):
                 and node_id = :node""", {"mail":credentials["repoze.who.userid"], "node":node_id})
         if has_right.rowcount == 0 :
             self.unmet()
+
+class can_write(Predicate):
+    message = ""
+
+    def __init__(self, **kwargs):
+        pass
+
+    def evaluate(self, environ, credentials):
+        node_id = environ['webob.adhoc_attrs']['validation']['values']['node_id']
+        has_right = session.execute("""
+                select *
+                from pod_group_node pgn
+                join pod_user_group pug on pug.group_id = pgn.group_id
+                join pod_user pu on pug.user_id = pu.user_id
+                where rights > 1
+                and email_address = :mail
+                and node_id = :node""", {"mail":credentials["repoze.who.userid"], "node":node_id})
+        if has_right.rowcount == 0 :
+            self.unmet()