Merge pull request #17 from postatum/92828042_private_fields

Apply privacy filtering to fields

nefertari/authentication/models.py

@@ -44,6 +44,9 @@ class AuthUser(eng.BaseDocument):
 
     uid = property(lambda self: str(self.id))
 
+    def is_admin(self):
+        return 'admin' in self.groups
+
     def verify_password(self, password):
         return crypt.check(self.password, password)
 

nefertari/view.py

@@ -131,14 +131,29 @@ def get_debug(self, package=None):
         return asbool(self.request.registry.settings.get(key))
 
     def setup_default_wrappers(self):
+        root_resource = getattr(self, 'root_resource', None)
+        auth_enabled = root_resource and root_resource.auth
+
         self._after_calls['index'] = [
             wrappers.wrap_in_dict(self.request),
+        ]
+        if auth_enabled:
+            self._after_calls['index'] += [
+                wrappers.apply_privacy(self.request),
+            ]
+        self._after_calls['index'] += [
             wrappers.add_meta(self.request),
             wrappers.add_etag(self.request),
         ]
 
         self._after_calls['show'] = [
             wrappers.wrap_in_dict(self.request),
+        ]
+        if auth_enabled:
+            self._after_calls['show'] += [
+                wrappers.apply_privacy(self.request),
+            ]
+        self._after_calls['show'] += [
             wrappers.add_meta(self.request),
         ]
 

nefertari/wrappers.py

@@ -74,7 +74,6 @@ def __init__(self, request):
 
     def __call__(self, **kwargs):
         '''converts objects in `result` into dicts'''
-
         result = kwargs['result']
         if isinstance(result, dict):
             return result
@@ -96,6 +95,57 @@ def __call__(self, **kwargs):
         return result
 
 
+class apply_privacy(object):
+    def __init__(self, request):
+        self.request = request
+
+    def _filter_fields(self, data):
+        from nefertari.engine import get_document_cls
+        try:
+            model_cls = get_document_cls(data['_type'])
+        except ValueError as ex:
+            log.error(str(ex))
+            return data
+
+        hidden_fields = set(getattr(model_cls, '_hidden_fields', None) or [])
+        auth_fields = set(getattr(model_cls, '_auth_fields', None) or [])
+        fields = set(data.keys())
+
+        user = getattr(self.request, 'user', None)
+        if self.request:
+            # User authenticated
+            if user:
+                if not user.is_admin():
+                    fields -= hidden_fields
+
+            # User not authenticated
+            else:
+                fields -= auth_fields
+                fields -= hidden_fields
+        else:
+            fields -= hidden_fields
+
+        fields.add('_type')
+        return data.subset(fields)
+
+    def __call__(self, **kwargs):
+        result = kwargs['result']
+        data = result.get('data', result)
+        if not data:
+            return data
+
+        if issequence(data) and not isinstance(data, dict):
+            data = [apply_privacy(self.request)(result=d) for d in data]
+        else:
+            data = self._filter_fields(data)
+
+        if 'data' in result:
+            result['data'] = data
+        else:
+            result = data
+        return result
+
+
 class wrap_in_dict(object):
     def __init__(self, request):
         self.request = request