check type of u.permissions, just to be sure

mozilla · Dec 16, 2014 · 1a0e0c5 · 1a0e0c5
1 parent 0564386
commit 1a0e0c5
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 0 deletions.
diff --git a/relengapi/blueprints/tokenauth/test_tokenauth.py b/relengapi/blueprints/tokenauth/test_tokenauth.py
@@ -21,6 +21,7 @@ def app_setup(app):
     # utility endpoint
     @app.route('/test_tokenauth')
     def test_route():
+        assert isinstance(current_user.permissions, set)
         return json.dumps({
             'id': current_user.get_id(),
             'permissions': sorted(str(a) for a in current_user.permissions),

diff --git a/relengapi/lib/auth/__init__.py b/relengapi/lib/auth/__init__.py
@@ -120,6 +120,8 @@ def _request_loader(request):
     for loader in _request_loaders:
         u = loader(request)
         if u:
+            if not isinstance(u.permissions, set):
+                raise TypeError("user permissions must be a set")
             return u