Added logic to check if user is allowed to see requested data #89 #197

Merged
edraft merged 2 commits from #89 into 1.0.0 2023-02-12 20:35:55 +01:00
Showing only changes of commit 60990db88d - Show all commits

View File

@ -52,9 +52,9 @@ class QueryABC(ObjectType):
if user == "system" or user.auth_role == AuthRoleEnum.admin:
return self._resolve_collection(collection, *args, **kwargs)
for x in collection:
for x in collection.to_list():
edraft marked this conversation as resolved Outdated
for x in collection:
    if not self._can_user_see_element(user, x):
        return List()

Sobald ein Element in der Collection von einem User nicht gesehen werden darf, wird die ganze Collection verworfen?

```python for x in collection: if not self._can_user_see_element(user, x): return List() ``` Sobald ein Element in der Collection von einem User nicht gesehen werden darf, wird die ganze Collection verworfen?
if not self._can_user_see_element(user, x):
return List()
collection.remove(x)
return self._resolve_collection(collection, *args, **kwargs)