Skip to content

Commit 963d4a3

Browse files
MaffoochMaffooch
committed
Refactor permission classes for risk acceptance and findings in views
1 parent d248d12 commit 963d4a3

2 files changed

Lines changed: 70 additions & 118 deletions

File tree

‎dojo/api_v2/permissions.py‎

Lines changed: 48 additions & 99 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,3 @@
1-
import re
21

32
from django.db.models import Model
43
from django.shortcuts import get_object_or_404
@@ -305,15 +304,6 @@ def has_object_permission(self, request, view, obj):
305304
)
306305

307306

308-
class UserHasEngagementRelatedObjectPermission(BaseRelatedObjectPermission):
309-
permission_map = {
310-
"get_permission": Permissions.Engagement_View,
311-
"put_permission": Permissions.Engagement_Edit,
312-
"delete_permission": Permissions.Engagement_Edit,
313-
"post_permission": Permissions.Engagement_Edit,
314-
}
315-
316-
317307
class UserHasEngagementPermission(permissions.BasePermission):
318308
def has_permission(self, request, view):
319309
return check_post_permission(
@@ -330,96 +320,67 @@ def has_object_permission(self, request, view, obj):
330320
)
331321

332322

333-
class UserHasRiskAcceptancePermission(permissions.BasePermission):
334-
# Permission checks for related objects (like notes or metadata) can be moved
335-
# into a seperate class, when the legacy authorization will be removed.
336-
path_risk_acceptance_post = re.compile(r"^/api/v2/risk_acceptances/$")
337-
path_risk_acceptance = re.compile(r"^/api/v2/risk_acceptances/\d+/$")
323+
class UserHasEngagementRelatedObjectPermission(BaseRelatedObjectPermission):
324+
permission_map = {
325+
"get_permission": Permissions.Engagement_View,
326+
"put_permission": Permissions.Engagement_Edit,
327+
"delete_permission": Permissions.Engagement_Edit,
328+
"post_permission": Permissions.Engagement_Edit,
329+
}
330+
338331

332+
class UserHasRiskAcceptancePermission(permissions.BasePermission):
339333
def has_permission(self, request, view):
340-
if UserHasRiskAcceptancePermission.path_risk_acceptance_post.match(
341-
request.path,
342-
) or UserHasRiskAcceptancePermission.path_risk_acceptance.match(
343-
request.path,
344-
):
345-
return check_post_permission(
346-
request, Product, "product", Permissions.Risk_Acceptance,
347-
)
348-
# related object only need object permission
334+
# The previous implementation only checked for the object permission if the path was
335+
# /api/v2/risk_acceptances/, but the path has always been /api/v2/risk_acceptance/ (notice the missing "s")
336+
# So there really has not been a notion of a post permission check for risk acceptances.
337+
# It would be best to leave as is to not break any existing implementations.
349338
return True
350339

351340
def has_object_permission(self, request, view, obj):
352-
if UserHasRiskAcceptancePermission.path_risk_acceptance_post.match(
353-
request.path,
354-
) or UserHasRiskAcceptancePermission.path_risk_acceptance.match(
355-
request.path,
356-
):
357-
return check_object_permission(
358-
request,
359-
obj,
360-
Permissions.Risk_Acceptance,
361-
Permissions.Risk_Acceptance,
362-
Permissions.Risk_Acceptance,
363-
)
364341
return check_object_permission(
365342
request,
366343
obj,
367344
Permissions.Risk_Acceptance,
368345
Permissions.Risk_Acceptance,
369346
Permissions.Risk_Acceptance,
370-
Permissions.Risk_Acceptance,
371347
)
372348

373349

374-
class UserHasFindingPermission(permissions.BasePermission):
375-
# Permission checks for related objects (like notes or metadata) can be moved
376-
# into a seperate class, when the legacy authorization will be removed.
377-
path_finding_post = re.compile(r"^/api/v2/findings/$")
378-
path_finding = re.compile(r"^/api/v2/findings/\d+/$")
379-
path_stub_finding_post = re.compile(r"^/api/v2/stub_findings/$")
380-
path_stub_finding = re.compile(r"^/api/v2/stub_findings/\d+/$")
350+
class UserHasRiskAcceptanceRelatedObjectPermission(BaseRelatedObjectPermission):
351+
permission_map = {
352+
"get_permission": Permissions.Risk_Acceptance,
353+
"put_permission": Permissions.Risk_Acceptance,
354+
"delete_permission": Permissions.Risk_Acceptance,
355+
"post_permission": Permissions.Risk_Acceptance,
356+
}
357+
381358

359+
class UserHasFindingPermission(permissions.BasePermission):
382360
def has_permission(self, request, view):
383-
if (
384-
UserHasFindingPermission.path_finding_post.match(request.path)
385-
or UserHasFindingPermission.path_finding.match(request.path)
386-
or UserHasFindingPermission.path_stub_finding_post.match(
387-
request.path,
388-
)
389-
or UserHasFindingPermission.path_stub_finding.match(request.path)
390-
):
391-
return check_post_permission(
392-
request, Test, "test", Permissions.Finding_Add,
393-
)
394-
# related object only need object permission
395-
return True
361+
return check_post_permission(
362+
request, Test, "test", Permissions.Finding_Add,
363+
)
396364

397365
def has_object_permission(self, request, view, obj):
398-
if (
399-
UserHasFindingPermission.path_finding_post.match(request.path)
400-
or UserHasFindingPermission.path_finding.match(request.path)
401-
or UserHasFindingPermission.path_stub_finding_post.match(
402-
request.path,
403-
)
404-
or UserHasFindingPermission.path_stub_finding.match(request.path)
405-
):
406-
return check_object_permission(
407-
request,
408-
obj,
409-
Permissions.Finding_View,
410-
Permissions.Finding_Edit,
411-
Permissions.Finding_Delete,
412-
)
413366
return check_object_permission(
414367
request,
415368
obj,
416369
Permissions.Finding_View,
417370
Permissions.Finding_Edit,
418-
Permissions.Finding_Edit,
419-
Permissions.Finding_Edit,
371+
Permissions.Finding_Delete,
420372
)
421373

422374

375+
class UserHasFindingRelatedObjectPermission(BaseRelatedObjectPermission):
376+
permission_map = {
377+
"get_permission": Permissions.Finding_View,
378+
"put_permission": Permissions.Finding_Edit,
379+
"delete_permission": Permissions.Finding_Edit,
380+
"post_permission": Permissions.Finding_Edit,
381+
}
382+
383+
423384
class UserHasImportPermission(permissions.BasePermission):
424385
def has_permission(self, request, view):
425386
# permission check takes place before validation, so we don't have access to serializer.validated_data()
@@ -776,42 +737,30 @@ def has_permission(self, request, view):
776737

777738

778739
class UserHasTestPermission(permissions.BasePermission):
779-
# Permission checks for related objects (like notes or metadata) can be moved
780-
# into a seperate class, when the legacy authorization will be removed.
781-
path_tests_post = re.compile(r"^/api/v2/tests/$")
782-
path_tests = re.compile(r"^/api/v2/tests/\d+/$")
783-
784740
def has_permission(self, request, view):
785-
if UserHasTestPermission.path_tests_post.match(
786-
request.path,
787-
) or UserHasTestPermission.path_tests.match(request.path):
788-
return check_post_permission(
789-
request, Engagement, "engagement", Permissions.Test_Add,
790-
)
791-
# related object only need object permission
792-
return True
741+
return check_post_permission(
742+
request, Engagement, "engagement", Permissions.Test_Add,
743+
)
793744

794745
def has_object_permission(self, request, view, obj):
795-
if UserHasTestPermission.path_tests_post.match(
796-
request.path,
797-
) or UserHasTestPermission.path_tests.match(request.path):
798-
return check_object_permission(
799-
request,
800-
obj,
801-
Permissions.Test_View,
802-
Permissions.Test_Edit,
803-
Permissions.Test_Delete,
804-
)
805746
return check_object_permission(
806747
request,
807748
obj,
808749
Permissions.Test_View,
809750
Permissions.Test_Edit,
810-
Permissions.Test_Edit,
811-
Permissions.Test_Edit,
751+
Permissions.Test_Delete,
812752
)
813753

814754

755+
class UserHasTestRelatedObjectPermission(BaseRelatedObjectPermission):
756+
permission_map = {
757+
"get_permission": Permissions.Test_View,
758+
"put_permission": Permissions.Test_Edit,
759+
"delete_permission": Permissions.Test_Edit,
760+
"post_permission": Permissions.Test_Edit,
761+
}
762+
763+
815764
class UserHasTestImportPermission(permissions.BasePermission):
816765
def has_permission(self, request, view):
817766
return check_post_permission(

0 commit comments

Comments
 (0)