Require "edit submissions", not "add submissions", for working with transcripts and translations #4749
Conversation
translation permission checks. It will pass once `change_submissions` becomes required for modifying transcripts and translations
working with transcripts and translations
| self.asset.assign_perm(other_user, PERM_ADD_SUBMISSIONS) | ||
| resp = self.client.post(schema['url'], modified, format='json') | ||
| assert resp.status_code == 404 | ||
|
|
||
| self.asset.assign_perm(other_user, PERM_VIEW_ASSET) | ||
| resp = self.client.post(schema['url'], modified, format='json') | ||
| assert resp.status_code == 404 | ||
|
|
||
| self.asset.assign_perm(other_user, PERM_CHANGE_ASSET) | ||
| resp = self.client.post(schema['url'], modified, format='json') | ||
| assert resp.status_code == 404 | ||
|
|
||
| self.asset.assign_perm(other_user, PERM_VIEW_SUBMISSIONS) | ||
| resp = self.client.post(schema['url'], modified, format='json') | ||
| assert resp.status_code == 403 |
There was a problem hiding this comment.
Not related to this PR but I wondering why PERM_VIEW_ASSET, PERM_CHANGE_ASSET return a 404 while PERM_VIEW_SUBMISSIONS returns a 403. I was assuming that as soon as user had PERM_VIEW_ASSET, users would receive a 403 when they don't have required permissions on nested objects.
There was a problem hiding this comment.
Good question; I'd assume it's just the usual DRF behavior of:
- Did you send a GET for a specific object that you are not allowed to see? We're not telling you whether or not it exists, so 404
- Did you try to take a disallowed action (POST, PATCH) on an object that you are allowed to see? → 403
I didn't expect nested objects to behave differently, but we can look into it more if you think something doesn't make sense
There was a problem hiding this comment.
Right! that's what I'm expecting too.
I missed an important line!
I was thinking the model was Asset. Everything is good.
| self.asset.assign_perm(other_user, PERM_ADD_SUBMISSIONS) | ||
| resp = self.client.post(schema['url'], modified, format='json') | ||
| assert resp.status_code == 404 | ||
|
|
||
| self.asset.assign_perm(other_user, PERM_VIEW_ASSET) | ||
| resp = self.client.post(schema['url'], modified, format='json') | ||
| assert resp.status_code == 404 | ||
|
|
||
| self.asset.assign_perm(other_user, PERM_CHANGE_ASSET) | ||
| resp = self.client.post(schema['url'], modified, format='json') | ||
| assert resp.status_code == 404 | ||
|
|
||
| self.asset.assign_perm(other_user, PERM_VIEW_SUBMISSIONS) | ||
| resp = self.client.post(schema['url'], modified, format='json') | ||
| assert resp.status_code == 403 |
There was a problem hiding this comment.
Right! that's what I'm expecting too.
I missed an important line!
I was thinking the model was Asset. Everything is good.
noliveleger
deleted the
require-change-not-add-for-transcripts-translations
branch
Checklist
Description
Doing any kind of work with transcripts or translations—whether adding a new one or editing an existing one—now always requires the "edit submissions" permission.