Merge pull request #76 from postatum/102163628_relationships_acl_filt…

…ering

Apply ACL filtering of ES documents' relationships

ramses/acl.py

@@ -180,12 +180,28 @@ def item_acl(self, item):
         db is used.
         """
         if self.es_based:
-            from nefertari_guards import engine as guards_engine
-            acl = getattr(item, '_acl', ())
-            return guards_engine.ACLField.objectify_acl([
-                ace._data for ace in acl])
+            from nefertari_guards.elasticsearch import get_es_item_acl
+            return get_es_item_acl(item)
         return item.get_acl()
 
+    def getitem_es(self, key):
+        """ Override to support ACL filtering.
+
+        To do so: passes `self.request` to `get_resource` and uses
+        `ACLFilterES`.
+        """
+        from nefertari_guards.elasticsearch import ACLFilterES
+        es = ACLFilterES(self.item_model.__name__)
+        params = {
+            'id': key,
+            'request': self.request,
+        }
+        obj = es.get_resource(**params)
+        obj.__acl__ = self.item_acl(obj)
+        obj.__parent__ = self
+        obj.__name__ = key
+        return obj
+
 
 def generate_acl(config, model_cls, raml_resource, es_based=True):
     """ Generate an ACL.

tests/test_acl.py

@@ -129,7 +129,6 @@ def test_correct_security_scheme(self, mock_parse):
         assert not instance.es_based
 
     def test_database_acls_option(self, mock_parse):
-        from ramses.acl import DatabaseACLMixin
         raml_resource = Mock(security_schemes=[
             Mock(type='x-ACL', settings={'collection': 4, 'item': 7})
         ])
@@ -141,10 +140,10 @@ def test_database_acls_option(self, mock_parse):
         config = config_mock()
         config.registry.database_acls = False
         acl_cls = acl.generate_acl(config, **kwargs)
-        assert not issubclass(acl_cls, DatabaseACLMixin)
+        assert not issubclass(acl_cls, acl.DatabaseACLMixin)
         config.registry.database_acls = True
         acl_cls = acl.generate_acl(config, **kwargs)
-        assert issubclass(acl_cls, DatabaseACLMixin)
+        assert issubclass(acl_cls, acl.DatabaseACLMixin)
 
 
 class TestBaseACL(object):