diff --git a/aleksis/core/schema/__init__.py b/aleksis/core/schema/__init__.py
index 1f5a2fa8e0723e883378541185e11d0649b18898..69a3bbf8229dca8d5424bf04a85647bffc7cb21a 100644
--- a/aleksis/core/schema/__init__.py
+++ b/aleksis/core/schema/__init__.py
@@ -8,7 +8,11 @@ from haystack.utils.loading import UnifiedIndex
from ..models import Notification, Person, TaskUserAssignment
from ..util.apps import AppConfig
from ..util.core_helpers import get_allowed_object_ids, get_app_module, get_app_packages, has_person
-from .celery_progress import CeleryProgressFetchedMutation, CeleryProgressType
+from .celery_progress import (
+ CeleryProgressFetchedMutation,
+ CeleryProgressMetaType,
+ CeleryProgressType,
+)
from .group import GroupType # noqa
from .installed_apps import AppType
from .notification import MarkNotificationReadMutation, NotificationType
@@ -37,15 +41,18 @@ class Query(graphene.ObjectType):
)
def resolve_notifications(root, info, **kwargs):
- # FIXME do permission stuff
- return Notification.objects.all()
+ return NotificationType.get_queryset(
+ Notification.objects.all().order_by("-created"),
+ info,
+ )
def resolve_persons(root, info, **kwargs):
- # FIXME do permission stuff
- return Person.objects.all()
+ return PersonType.get_queryset(Person.objects.all(), info).all()
def resolve_person_by_id(root, info, id): # noqa
- return Person.objects.get(pk=id)
+ return PersonType.get_queryset(
+ Person.objects.filter(pk=id), info, "core.view_person_rule"
+ ).first()
def resolve_who_am_i(root, info, **kwargs):
if has_person(info.context.user):
@@ -60,10 +67,13 @@ class Query(graphene.ObjectType):
return [app for app in apps.get_app_configs() if isinstance(app, AppConfig)]
def resolve_celery_progress_by_task_id(root, info, task_id, **kwargs):
- task = TaskUserAssignment.objects.get(task_result__task_id=task_id)
+ task = CeleryProgressMetaType.get_queryset(
+ TaskUserAssignment.objects.filter(task_result__task_id=task_id),
+ info,
+ ).first()
- if not info.context.user.has_perm("core.view_progress_rule", task):
- return None
+ if not task:
+ raise PermissionDenied()
progress = task.get_progress_with_meta()
return progress
diff --git a/aleksis/core/schema/base.py b/aleksis/core/schema/base.py
new file mode 100644
index 0000000000000000000000000000000000000000..363c6b8ac849affcba2d9c1cbf9eefa74498121d
--- /dev/null
+++ b/aleksis/core/schema/base.py
@@ -0,0 +1,14 @@
+from graphene_django import DjangoObjectType
+
+from ..util.core_helpers import queryset_rules_filter
+
+
+class RulesObjectType(DjangoObjectType):
+ class Meta:
+ abstract = True
+
+ @classmethod
+ def get_queryset(cls, queryset, info, perm):
+ q = super().get_queryset(queryset, info)
+
+ return queryset_rules_filter(info.context, q, perm)
diff --git a/aleksis/core/schema/celery_progress.py b/aleksis/core/schema/celery_progress.py
index 941d18f1d5e79db17a549d30dbb90f0c42310a25..c6fe93dd06b8e853d6d0b3f748ad1d6b2b4534b5 100644
--- a/aleksis/core/schema/celery_progress.py
+++ b/aleksis/core/schema/celery_progress.py
@@ -2,9 +2,9 @@ from django.contrib.messages.constants import DEFAULT_TAGS
import graphene
from graphene import ObjectType
-from graphene_django import DjangoObjectType
from ..models import TaskUserAssignment
+from .base import RulesObjectType
class CeleryProgressMessage(ObjectType):
@@ -28,7 +28,7 @@ class CeleryProgressAdditionalButtonType(ObjectType):
icon = graphene.String()
-class CeleryProgressMetaType(DjangoObjectType):
+class CeleryProgressMetaType(RulesObjectType):
additional_button = graphene.Field(CeleryProgressAdditionalButtonType, required=False)
task_id = graphene.String(required=True)
@@ -47,6 +47,10 @@ class CeleryProgressMetaType(DjangoObjectType):
"additional_button",
)
+ @classmethod
+ def get_queryset(cls, queryset, info, perm="core.view_progress_rule"):
+ return super().get_queryset(queryset, info, perm)
+
def resolve_additional_button(root, info, **kwargs):
if not root.additional_button_title or not root.additional_button_url:
return None
diff --git a/aleksis/core/schema/group.py b/aleksis/core/schema/group.py
index 327daff3dd09d54053b683ba4cefb71da8ba6e5b..70f00bd1d6793916a9c954747e6242a09a12b519 100644
--- a/aleksis/core/schema/group.py
+++ b/aleksis/core/schema/group.py
@@ -1,8 +1,11 @@
-from graphene_django import DjangoObjectType
-
from ..models import Group
+from .base import RulesObjectType
-class GroupType(DjangoObjectType):
+class GroupType(RulesObjectType):
class Meta:
model = Group
+
+ @classmethod
+ def get_queryset(cls, queryset, info, perm="core.view_groups_rule"):
+ return super().get_queryset(queryset, info, perm)
diff --git a/aleksis/core/schema/notification.py b/aleksis/core/schema/notification.py
index 114f92b32d9658208013144fe2d7c2d2b0157595..105ed13662addb54e64565ec0e147d610e68315d 100644
--- a/aleksis/core/schema/notification.py
+++ b/aleksis/core/schema/notification.py
@@ -1,13 +1,17 @@
import graphene
-from graphene_django import DjangoObjectType
from ..models import Notification
+from .base import RulesObjectType
-class NotificationType(DjangoObjectType):
+class NotificationType(RulesObjectType):
class Meta:
model = Notification
+ @classmethod
+ def get_queryset(cls, queryset, info, perm="core.view_notifications_rule"):
+ return super().get_queryset(queryset, info, perm)
+
class MarkNotificationReadMutation(graphene.Mutation):
class Arguments:
diff --git a/aleksis/core/schema/person.py b/aleksis/core/schema/person.py
index a48447273d6a8c83ae1dc22b525458f7d661332a..c7b4fd6ff7004ff5b0b7b5618e1d2a7fb47ba292 100644
--- a/aleksis/core/schema/person.py
+++ b/aleksis/core/schema/person.py
@@ -1,14 +1,14 @@
from django.utils import timezone
import graphene
-from graphene_django import DjangoObjectType
from graphene_django.forms.mutation import DjangoModelFormMutation
from ..forms import PersonForm
from ..models import Person
+from .base import RulesObjectType
-class PersonType(DjangoObjectType):
+class PersonType(RulesObjectType):
class Meta:
model = Person
@@ -21,6 +21,10 @@ class PersonType(DjangoObjectType):
def resolve_notifications(root: Person, info, **kwargs):
return root.notifications.filter(send_at__lte=timezone.now()).order_by("read", "-created")
+ @classmethod
+ def get_queryset(cls, queryset, info, perm="core.view_persons_rule"):
+ return super().get_queryset(queryset, info, perm)
+
class PersonMutation(DjangoModelFormMutation):
person = graphene.Field(PersonType)