Skip to content

Commit

Permalink
fix workflow (#12238)
Browse files Browse the repository at this point in the history
  • Loading branch information
@mattiagiupponi
mattiagiupponi authored May 17, 2024
1 parent 9d163e3 commit 684a1f3
Show file tree
Hide file tree
Showing 4 changed files with 73 additions and 6 deletions.
14 changes: 12 additions & 2 deletions geonode/resource/manager.py
View file
Original file line number Diff line number Diff line change
Expand Up @@ -849,7 +849,12 @@ def _safe_assign_perm(perm, user_or_group, obj=None):
)
else:
for user_group in get_user_groups(_owner):
if not skip_registered_members_common_group(user_group):
# if AdvancedSecurityWorkflowManager.is_auto_publishing_workflow() is False,
# means that at least one config of the advanced workflow is set, which means that users group get view_permissions
if (
not skip_registered_members_common_group(user_group)
and not AdvancedSecurityWorkflowManager.is_auto_publishing_workflow()
):
_safe_assign_perm("view_resourcebase", user_group, _resource.get_self_resource())
_prev_perm = (
_perm_spec["groups"].get(user_group, []) if "groups" in _perm_spec else []
Expand All @@ -873,7 +878,12 @@ def _safe_assign_perm(perm, user_or_group, obj=None):
)
else:
for user_group in get_user_groups(_owner):
if not skip_registered_members_common_group(user_group):
# if AdvancedSecurityWorkflowManager.is_auto_publishing_workflow() is False,
# means that at least one config of the advanced workflow is set, which means that users group get view_permissions
if (
not skip_registered_members_common_group(user_group)
and not AdvancedSecurityWorkflowManager.is_auto_publishing_workflow()
):
_safe_assign_perm(
"download_resourcebase", user_group, _resource.get_self_resource()
)
Expand Down
14 changes: 12 additions & 2 deletions geonode/security/models.py
View file
Original file line number Diff line number Diff line change
Expand Up @@ -201,15 +201,25 @@ def set_default_permissions(self, owner=None, created=False):
perm_spec["groups"][anonymous_group] = ["view_resourcebase"]
else:
for user_group in user_groups:
if not skip_registered_members_common_group(user_group):
# if aswm.is_auto_publishing_workflow() is False, means that at least one config of the advanced workflow
# is set, which means that users group get view_permissions
if (
not skip_registered_members_common_group(user_group)
and not AdvancedSecurityWorkflowManager.is_auto_publishing_workflow()
):
perm_spec["groups"][user_group] = ["view_resourcebase"]

anonymous_can_download = settings.DEFAULT_ANONYMOUS_DOWNLOAD_PERMISSION
if anonymous_can_download:
perm_spec["groups"][anonymous_group] = ["view_resourcebase", "download_resourcebase"]
else:
for user_group in user_groups:
if not skip_registered_members_common_group(user_group):
# if aswm.is_auto_publishing_workflow() is False, means that at least one config of the advanced workflow
# is set, which means that users group get view_permissions
if (
not skip_registered_members_common_group(user_group)
and not AdvancedSecurityWorkflowManager.is_auto_publishing_workflow()
):
perm_spec["groups"][user_group] = ["view_resourcebase", "download_resourcebase"]

AdvancedSecurityWorkflowManager.handle_moderated_uploads(self.uuid, instance=self)
Expand Down
48 changes: 48 additions & 0 deletions geonode/security/tests.py
View file
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,7 @@
import json
import base64
import logging
import uuid
import requests
import importlib
import mock
Expand Down Expand Up @@ -2234,6 +2235,53 @@ def test_permissions_on_user_role_promote_to_manager_only_RESOURCE_PUBLISHING_ac
set(expected_perms), set(perms_got), msg=f"use case #0 - user: {authorized_subject.username}"
)

@override_settings(DEFAULT_ANONYMOUS_VIEW_PERMISSION=False)
def test_if_anonymoys_default_perms_is_false_should_not_assign_perms_to_user_group(self):
"""
if DEFAULT_ANONYMOUS_VIEW_PERMISSION is False, the user's group should not get any permission
"""

resource = resource_manager.create(str(uuid.uuid4), Dataset, defaults={"owner": self.group_member})
self.assertFalse(self.group_profile.group in resource.get_all_level_info()["groups"].keys())

@override_settings(DEFAULT_ANONYMOUS_DOWNLOAD_PERMISSION=False)
def test_if_anonymoys_default_download_perms_is_false_should_not_assign_perms_to_user_group(self):
"""
if DEFAULT_ANONYMOUS_DOWNLOAD_PERMISSION is False, the user's group should not get any permission
"""

resource = resource_manager.create(str(uuid.uuid4), Dataset, defaults={"owner": self.group_member})
self.assertFalse(self.group_profile.group in resource.get_all_level_info()["groups"].keys())

@override_settings(DEFAULT_ANONYMOUS_DOWNLOAD_PERMISSION=False)
@override_settings(RESOURCE_PUBLISHING=True)
def test_if_anonymoys_default_perms_is_false_should_assign_perms_to_user_group_if_advanced_workflow_is_on(self):
"""
if DEFAULT_ANONYMOUS_DOWNLOAD_PERMISSION is False and the advanced workflow is activate
the user's group should get the view and download permission
"""

resource = resource_manager.create(str(uuid.uuid4), Dataset, defaults={"owner": self.group_member})
self.assertTrue(self.group_profile.group in resource.get_all_level_info()["groups"].keys())
group_val = resource.get_all_level_info()["groups"][self.group_profile.group]
self.assertSetEqual({"view_resourcebase", "download_resourcebase"}, set(group_val))

@override_settings(DEFAULT_ANONYMOUS_VIEW_PERMISSION=False)
@override_settings(ADMIN_MODERATE_UPLOADS=True)
def test_if_anonymoys_default_perms_is_false_should_assign_perms_to_user_group_if_advanced_workflow_is_on_moderate(
self,
):
"""
if DEFAULT_ANONYMOUS_VIEW_PERMISSION is False and the advanced workflow is activate
the user's group should get the view and download permission
"""

resource = resource_manager.create(str(uuid.uuid4), Dataset, defaults={"owner": self.group_member})

self.assertTrue(self.group_profile.group in resource.get_all_level_info()["groups"].keys())
group_val = resource.get_all_level_info()["groups"][self.group_profile.group]
self.assertSetEqual({"view_resourcebase", "download_resourcebase"}, set(group_val))


@override_settings(RESOURCE_PUBLISHING=True)
@override_settings(ADMIN_MODERATE_UPLOADS=True)
Expand Down
3 changes: 1 addition & 2 deletions geonode/security/utils.py
View file
Original file line number Diff line number Diff line change
Expand Up @@ -224,8 +224,7 @@ def get_geoapp_subtypes():


def skip_registered_members_common_group(user_group):
_members_group_name = groups_settings.REGISTERED_MEMBERS_GROUP_NAME
if (settings.RESOURCE_PUBLISHING or settings.ADMIN_MODERATE_UPLOADS) and _members_group_name == user_group.name:
if groups_settings.REGISTERED_MEMBERS_GROUP_NAME == user_group.name:
return True
return False

Expand Down

0 comments on commit 684a1f3

Please sign in to comment.