Resolve: Unprotect GraphQL endpoint

Closes #743 (closed)

aleksis/core/schema/__init__.py

@@ -8,7 +8,11 @@ from haystack.utils.loading import UnifiedIndex
 from ..models import Notification, Person, TaskUserAssignment
 from ..util.apps import AppConfig
 from ..util.core_helpers import get_allowed_object_ids, get_app_module, get_app_packages, has_person
-from .celery_progress import CeleryProgressFetchedMutation, CeleryProgressType
+from .celery_progress import (
+    CeleryProgressFetchedMutation,
+    CeleryProgressMetaType,
+    CeleryProgressType,
+)
 from .group import GroupType  # noqa
 from .installed_apps import AppType
 from .notification import MarkNotificationReadMutation, NotificationType
@@ -37,15 +41,18 @@ class Query(graphene.ObjectType):
     )
 
     def resolve_notifications(root, info, **kwargs):
-        # FIXME do permission stuff
-        return Notification.objects.all()
+        return NotificationType.get_queryset(
+            Notification.objects.all().order_by("-created"),
+            info,
+        )
 
     def resolve_persons(root, info, **kwargs):
-        # FIXME do permission stuff
-        return Person.objects.all()
+        return PersonType.get_queryset(Person.objects.all(), info).all()
 
     def resolve_person_by_id(root, info, id):  # noqa
-        return Person.objects.get(pk=id)
+        return PersonType.get_queryset(
+            Person.objects.filter(pk=id), info, "core.view_person_rule"
+        ).first()
 
     def resolve_who_am_i(root, info, **kwargs):
         if has_person(info.context.user):
@@ -60,10 +67,13 @@ class Query(graphene.ObjectType):
         return [app for app in apps.get_app_configs() if isinstance(app, AppConfig)]
 
     def resolve_celery_progress_by_task_id(root, info, task_id, **kwargs):
-        task = TaskUserAssignment.objects.get(task_result__task_id=task_id)
+        task = CeleryProgressMetaType.get_queryset(
+            TaskUserAssignment.objects.filter(task_result__task_id=task_id),
+            info,
+        ).first()
 
-        if not info.context.user.has_perm("core.view_progress_rule", task):
-            return None
+        if not task:
+            raise PermissionDenied()
         progress = task.get_progress_with_meta()
         return progress