external/aurweb
0
0
Fork 0
mirror of https://gitlab.archlinux.org/archlinux/aurweb.git synced 2025-02-03 10:43:03 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

change(models.user): can_edit_user should check account type id priority

Browse source 
The credential alone does not completely encapsulate our new
requirements for editing an account.

Signed-off-by: Kevin Morris <kevr@0cost.org>
This commit is contained in:
Kevin Morris 2021-12-27 00:07:44 -08:00
parent b27dab99d8
commit 260b67c49e
No known key found for this signature in database
GPG key ID: F7E46DED420788F3
2 changed files with 79 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

24
aurweb/models/user.py
View file

@ -182,14 +182,24 @@ class User(Base):
aurweb.models.account_type.TRUSTED_USER_AND_DEV_ID,
}
def can_edit_user(self, user):
""" Can this account record edit the target user? It must either
be the target user or a user with enough permissions to do so.
:param user: Target user
:return: Boolean indicating whether this instance can edit `user`
def can_edit_user(self, target: "User") -> bool:
"""
return self == user or self.is_trusted_user() or self.is_developer()
Whether this User instance can edit `target`.
This User can edit user `target` if we both: have credentials and
self.AccountTypeID is greater or equal to `target`.AccountTypeID.
In short, a user must at least have credentials and be at least
the same account type as the target.
User < Trusted User < Developer < Trusted User & Developer
:param target: Target User to be edited
:return: Boolean indicating whether `self` can edit `target`
"""
from aurweb.auth import creds
has_cred = self.has_credential(creds.ACCOUNT_EDIT, approved=[target])
return has_cred and self.AccountTypeID >= target.AccountTypeID
def voted_for(self, package) -> bool:
""" Has this User voted for package? """