From 1940bb02741f142efadd954f8672ab7c56b66e88 Mon Sep 17 00:00:00 2001
From: Matthias Dellweg <mdellweg@redhat.com>
Date: Wed, 6 Sep 2023 16:13:45 +0200
Subject: [PATCH] Adjust access policies for labels

fixes #3243
---
 CHANGES/3243.feature                | 1 +
 pulp_rpm/app/viewsets/repository.py | 8 ++++----
 2 files changed, 5 insertions(+), 4 deletions(-)
 create mode 100644 CHANGES/3243.feature

diff --git a/CHANGES/3243.feature b/CHANGES/3243.feature
new file mode 100644
index 000000000..a96980fe8
--- /dev/null
+++ b/CHANGES/3243.feature
@@ -0,0 +1 @@
+Adjusted default access policies for new labels api.
diff --git a/pulp_rpm/app/viewsets/repository.py b/pulp_rpm/app/viewsets/repository.py
index 74edf00ab..3f555dfc2 100644
--- a/pulp_rpm/app/viewsets/repository.py
+++ b/pulp_rpm/app/viewsets/repository.py
@@ -77,7 +77,7 @@ class RpmRepositoryViewSet(RepositoryViewSet, ModifyRepositoryActionMixin, Roles
                 ],
             },
             {
-                "action": ["update", "partial_update"],
+                "action": ["update", "partial_update", "set_label", "unset_label"],
                 "principal": "authenticated",
                 "effect": "allow",
                 "condition": [
@@ -325,7 +325,7 @@ class RpmRemoteViewSet(RemoteViewSet, RolesMixin):
                 "condition": "has_model_or_domain_perms:rpm.add_rpmremote",
             },
             {
-                "action": ["update", "partial_update"],
+                "action": ["update", "partial_update", "set_label", "unset_label"],
                 "principal": "authenticated",
                 "effect": "allow",
                 "condition": [
@@ -404,7 +404,7 @@ class UlnRemoteViewSet(RemoteViewSet, RolesMixin):
                 "condition": "has_model_or_domain_perms:rpm.add_ulnremote",
             },
             {
-                "action": ["update", "partial_update"],
+                "action": ["update", "partial_update", "set_label", "unset_label"],
                 "principal": "authenticated",
                 "effect": "allow",
                 "condition": [
@@ -613,7 +613,7 @@ class RpmDistributionViewSet(DistributionViewSet, RolesMixin):
                 ],
             },
             {
-                "action": ["update", "partial_update"],
+                "action": ["update", "partial_update", "set_label", "unset_label"],
                 "principal": "authenticated",
                 "effect": "allow",
                 "condition": [