OpenSlides/server/openslides/motions/access_permissions.py

206 lines
6.9 KiB
Python
Raw Normal View History

import json
from typing import Any, Dict, List
2019-10-29 09:44:19 +01:00
from ..poll.access_permissions import (
BaseOptionAccessPermissions,
2019-10-29 09:44:19 +01:00
BasePollAccessPermissions,
BaseVoteAccessPermissions,
)
2018-08-22 22:00:08 +02:00
from ..utils.access_permissions import BaseAccessPermissions
from ..utils.auth import async_has_perm, async_in_some_groups
class MotionAccessPermissions(BaseAccessPermissions):
"""
Access permissions container for Motion and MotionViewSet.
"""
2019-01-06 16:22:33 +01:00
base_permission = "motions.can_see"
async def get_restricted_data(
2019-01-06 16:22:33 +01:00
self, full_data: List[Dict[str, Any]], user_id: int
) -> List[Dict[str, Any]]:
"""
Returns the restricted serialized data for the instance prepared for
the user. Removes motion if the user has not the permission to see
the motion in this state. Removes comments sections for
some unauthorized users. Ensures that a user can only see his own
personal notes.
"""
# Parse data.
2019-01-06 16:22:33 +01:00
if await async_has_perm(user_id, "motions.can_see"):
# TODO: Refactor this after personal_notes system is refactored.
data = []
for full in full_data:
# Check if user is submitter of this motion.
if user_id:
is_submitter = user_id in [
2019-01-06 16:22:33 +01:00
submitter["user_id"] for submitter in full.get("submitters", [])
]
else:
# Anonymous users can not be submitters.
is_submitter = False
# Check see permission for this motion.
restriction = full["state_restriction"]
# Managers can see all motions.
permission = await async_has_perm(user_id, "motions.can_manage")
# If restriction field is an empty list, everybody can see the motion.
permission = permission or not restriction
if not permission:
# Parse values of restriction field.
# If at least one restriction is ok, permissions are granted.
for value in restriction:
2020-08-31 13:24:16 +02:00
if (
value
in (
"motions.can_see_internal",
"motions.can_manage_metadata",
"motions.can_manage",
)
and await async_has_perm(user_id, value)
):
permission = True
break
elif value == "is_submitter" and is_submitter:
permission = True
break
# Parse single motion.
if permission:
full_copy = json.loads(json.dumps(full))
2019-01-06 16:22:33 +01:00
full_copy["comments"] = []
for comment in full["comments"]:
if await async_in_some_groups(
user_id, comment["read_groups_id"]
):
full_copy["comments"].append(comment)
data.append(full_copy)
else:
data = []
return data
2016-09-10 18:49:38 +02:00
class MotionChangeRecommendationAccessPermissions(BaseAccessPermissions):
"""
Access permissions container for MotionChangeRecommendation and MotionChangeRecommendationViewSet.
"""
2019-01-06 16:22:33 +01:00
base_permission = "motions.can_see"
2016-09-10 18:49:38 +02:00
async def get_restricted_data(
2019-01-06 16:22:33 +01:00
self, full_data: List[Dict[str, Any]], user_id: int
) -> List[Dict[str, Any]]:
"""
Removes change recommendations if they are internal and the user has
not the can_manage permission. To see change recommendation the user needs
the can_see permission.
"""
# Parse data.
2019-01-06 16:22:33 +01:00
if await async_has_perm(user_id, "motions.can_see"):
has_manage_perms = await async_has_perm(user_id, "motions.can_manage")
data = []
for full in full_data:
2019-01-06 16:22:33 +01:00
if not full["internal"] or has_manage_perms:
data.append(full)
else:
data = []
return data
2016-09-10 18:49:38 +02:00
class MotionCommentSectionAccessPermissions(BaseAccessPermissions):
"""
Access permissions container for MotionCommentSection and MotionCommentSectionViewSet.
"""
2019-01-06 16:22:33 +01:00
base_permission = "motions.can_see"
async def get_restricted_data(
2019-01-06 16:22:33 +01:00
self, full_data: List[Dict[str, Any]], user_id: int
) -> List[Dict[str, Any]]:
"""
If the user has manage rights, he can see all sections. If not all sections
will be removed, when the user is not in at least one of the read_groups.
"""
data: List[Dict[str, Any]] = []
2019-01-06 16:22:33 +01:00
if await async_has_perm(user_id, "motions.can_manage"):
data = full_data
else:
for full in full_data:
2019-01-06 16:22:33 +01:00
read_groups = full.get("read_groups_id", [])
if await async_in_some_groups(user_id, read_groups):
data.append(full)
return data
class StatuteParagraphAccessPermissions(BaseAccessPermissions):
"""
Access permissions container for StatuteParagraph and StatuteParagraphViewSet.
"""
2019-01-06 16:22:33 +01:00
base_permission = "motions.can_see"
class CategoryAccessPermissions(BaseAccessPermissions):
"""
Access permissions container for Category and CategoryViewSet.
"""
2019-01-06 16:22:33 +01:00
base_permission = "motions.can_see"
class MotionBlockAccessPermissions(BaseAccessPermissions):
"""
Access permissions container for Category and CategoryViewSet.
"""
2019-01-06 16:22:33 +01:00
base_permission = "motions.can_see"
async def get_restricted_data(
self, full_data: List[Dict[str, Any]], user_id: int
) -> List[Dict[str, Any]]:
"""
Users without `motions.can_manage` cannot see internal blocks.
"""
data: List[Dict[str, Any]] = []
if await async_has_perm(user_id, "motions.can_manage"):
data = full_data
else:
data = [full for full in full_data if not full["internal"]]
return data
class WorkflowAccessPermissions(BaseAccessPermissions):
"""
Access permissions container for Workflow and WorkflowViewSet.
"""
2019-01-06 16:22:33 +01:00
base_permission = "motions.can_see"
2019-07-17 16:13:49 +02:00
class StateAccessPermissions(BaseAccessPermissions):
"""
Access permissions container for State and StateViewSet.
"""
base_permission = "motions.can_see"
2019-10-18 14:18:49 +02:00
2019-10-29 09:44:19 +01:00
class MotionPollAccessPermissions(BasePollAccessPermissions):
2019-10-18 14:18:49 +02:00
base_permission = "motions.can_see"
2019-10-29 09:44:19 +01:00
manage_permission = "motions.can_manage_polls"
2019-10-18 14:18:49 +02:00
class MotionOptionAccessPermissions(BaseOptionAccessPermissions):
base_permission = "motions.can_see"
manage_permission = "motions.can_manage_polls"
class MotionVoteAccessPermissions(BaseVoteAccessPermissions):
2019-10-18 14:18:49 +02:00
base_permission = "motions.can_see"
manage_permission = "motions.can_manage_polls"