diff options
| -rw-r--r-- | gn2/wqflask/oauth2/checks.py | 23 |
1 files changed, 23 insertions, 0 deletions
diff --git a/gn2/wqflask/oauth2/checks.py b/gn2/wqflask/oauth2/checks.py index 9a633b95..5f0d1376 100644 --- a/gn2/wqflask/oauth2/checks.py +++ b/gn2/wqflask/oauth2/checks.py @@ -39,3 +39,26 @@ def require_oauth2(func): return session.user_token().either(__clear_session__, __with_token__) return __token_valid__ + + +def require_oauth2_edit_resource_access(func): + """Check if a user has edit access for a given resource.""" + @wraps(func) + def __check_edit_access__(*args, **kwargs): + # Check edit access, if not return to the same page. + + # This is for a GET + resource_name = request.args.get("name", "") + # And for a POST request. + if request.method == "POST": + resource_name = request.form.get("name", "") + result = oauth2_get( + f"auth/resource/authorisation/{resource_name}" + ).either( + lambda _: {"roles": []}, + lambda val: val + ) + if "group:resource:edit-resource" not in result.get("roles", []): + return redirect(f"/datasets/{resource_name}") + return func(*args, **kwargs) + return __check_edit_access__ |