Remove unnecessary check for permissions in get_node

0soft · Apr 25, 2020 · 3582a6f · 3582a6f
1 parent 17108ac
commit 3582a6f
Show file tree

Hide file tree

Showing 2 changed files with 28 additions and 21 deletions.
diff --git a/graphene_django_plus/types.py b/graphene_django_plus/types.py
@@ -145,6 +145,9 @@ def get_queryset(cls, qs, info):
     @classmethod
     def get_node(cls, info, id):
         """Get the node instance given the relay global id."""
+        # NOTE: get_queryset will filter allowed models for the user so
+        # this will return None if he is not allowed to retrieve this
+
         if gql_optimizer is not None:
             # optimizer will ignore queryset so call the same as they call
             # but passing objects from get_queryset to keep our preferences
@@ -156,12 +159,6 @@ def get_node(cls, info, id):
         else:
             instance = super().get_node(info, id)
 
-        if instance is None:
-            return None
-
-        if not cls.check_object_permissions(info.context.user, instance):
-            raise PermissionDenied()
-
         return instance
 
     @classmethod

diff --git a/tests/test_types.py b/tests/test_types.py
@@ -2,7 +2,10 @@
 import json
 from unittest import mock
 
+from graphene_django import DjangoObjectType
+
 from .base import BaseTestCase
+from .schema import IssueType
 
 
 class TestTypes(BaseTestCase):
@@ -402,18 +405,25 @@ def test_result_no_gql_optimizer(self):
             }}},
         )
 
-        # issue (not allowed)
-        p_id = base64.b64encode('IssueType:{}'.format(
-            self.unallowed_issues[0].id,
-        ).encode()).decode()
-        r = self.query(
-            """
-            query {
-              issue (id: "%s") {
-                name
-              }
-            }
-            """ % (p_id, ),
-            op_name='issue'
-        )
-        self.assertResponseHasErrors(r)
+        with mock.patch.object(
+                IssueType,
+                'get_node',
+                lambda info, id: DjangoObjectType.get_node.__func__(IssueType, info, id)):
+            # issue (not allowed)
+            p_id = base64.b64encode('IssueType:{}'.format(
+                self.unallowed_issues[0].id,
+            ).encode()).decode()
+            r = self.query(
+                """
+                query {
+                  issue (id: "%s") {
+                    name
+                  }
+                }
+                """ % (p_id, ),
+                op_name='issue'
+            )
+            self.assertEqual(
+                json.loads(r.content),
+                {'data': {'issue': None}},
+            )