SPC-140 Allow collaborators to delete themselves

ckanext/spectrum/authz.py

@@ -16,11 +16,27 @@ def creators_manage_collaborators(next_auth, context, data_dict):
 
     if package.creator_user_id == user_obj.id:
         return {'success': True}
-
     else:
         return next_auth(context, data_dict)
 
 
+@toolkit.chained_auth_function
+def package_collaborator_delete(next_auth, context, data_dict):
+    """
+    Explicitly ensures that dataset collaborators can delete themselves.
+    """
+    model = context['model']
+    current_user = context['user']
+    requested_user = toolkit.get_or_bust(data_dict, 'user_id')
+    current_user_obj = model.User.get(current_user)
+    requested_user_obj = model.User.get(requested_user)
+
+    if current_user_obj.id == requested_user_obj.id:
+        return {'success': True}
+    else:
+        return creators_manage_collaborators(next_auth, context, data_dict)
+
+
 @toolkit.auth_disallow_anonymous_access
 def package_update(context, data_dict):
     """

ckanext/spectrum/plugin.py

@@ -99,8 +99,8 @@ def get_auth_functions(self):
         return {
             'package_update': spectrum_authz.package_update,
             'package_collaborator_create': spectrum_authz.creators_manage_collaborators,
-            'package_collaborator_delete': spectrum_authz.creators_manage_collaborators,
-            'package_collaborator_list': spectrum_authz.creators_manage_collaborators
+            'package_collaborator_list': spectrum_authz.creators_manage_collaborators,
+            'package_collaborator_delete': spectrum_authz.package_collaborator_delete
         }
 
     # IActions