refine code and add test

Signed-off-by: tdruez <tdruez@aboutcode.org>

Author: tdruez

dje/api_permissions.py

@@ -6,7 +6,6 @@
 # See https://aboutcode.org for more information about AboutCode FOSS projects.
 #
 
-
 from django.contrib.auth import get_user_model
 from django.core.exceptions import ObjectDoesNotExist
 
@@ -28,37 +27,22 @@ class CanManageObjectPermissions(permissions.BasePermission):
     """
     Allows managing object-level permissions if the user is:
     - a superuser, or
-    - the object's owner (configurable via ``owner_field`` on the View), or
-    - has a special manage permission (global or object-level).
+    - the object's owner (configurable via ``owner_field`` on the View).
     """
 
     owner_field = "created_by"
-    manage_permission_codename = "manage_object_permissions"
 
     def has_object_permission(self, request, view, obj):
         user = request.user
         if not user.is_authenticated:
             return False
 
-        # 1. Superusers always allowed
         if user.is_superuser:
             return True
 
-        # 2. Check if user matches object's owner field
-        # The field can be overridden on the ViewSet (e.g., owner_field = "owner")
         owner_field = getattr(view, "owner_field", self.owner_field)
         owner = getattr(obj, owner_field, None)
-        if owner == user:
-            return True
-
-        # 3. Check for specific manage permission (global or object-level)
-        app_label = obj._meta.app_label
-        codename = getattr(view, "manage_permission_codename", self.manage_permission_codename)
-        perm_name = f"{app_label}.{codename}"
-        if user.has_perm(perm_name) or user.has_perm(perm_name, obj):
-            return True
-
-        return False
+        return owner == user
 
 
 class ObjectPermissionSerializer(serializers.Serializer):
@@ -100,9 +84,9 @@ class ObjectPermissionsMixin:
     Mixin that adds a `/permissions/` endpoint for any object-level ViewSet.
     Supports GET (list), POST (assign), and DELETE (remove) operations.
 
-    GET /api/{model}/{uuid}/permissions/ → list all users and perms
-    POST /api/{model}/{uuid}/permissions/ → assign perms to a user
-    DELETE /api/{model}/{uuid}/permissions/ → remove perms from a user
+    GET /api/{model}/{uuid}/permissions/ list all users and perms
+    POST /api/{model}/{uuid}/permissions/ assign perms to a user
+    DELETE /api/{model}/{uuid}/permissions/ remove perms from a user
     """
 
     @action(

product_portfolio/tests/test_api.py

@@ -586,6 +586,70 @@ def test_api_product_endpoint_cyclonedx_sbom_action(self):
         self.assertEqual(status.HTTP_400_BAD_REQUEST, response.status_code)
         self.assertEqual("Spec version 10.10 not supported", response.data)
 
+    def test_api_product_endpoint_manage_permissions_action(self):
+        url = reverse("api_v2:product-manage-permissions", args=[self.product1.uuid])
+
+        # User without view_product gets 404 (object not in secured queryset)
+        self.client.login(username=self.base_user.username, password="secret")
+        response = self.client.get(url)
+        self.assertEqual(status.HTTP_404_NOT_FOUND, response.status_code)
+
+        # User with view_product but not owner gets 403
+        assign_perm("view_product", self.base_user, self.product1)
+        response = self.client.get(url)
+        self.assertEqual(status.HTTP_403_FORBIDDEN, response.status_code)
+
+        # Superuser can GET the permissions list
+        self.client.login(username=self.super_user.username, password="secret")
+        response = self.client.get(url)
+        self.assertEqual(status.HTTP_200_OK, response.status_code)
+        # base_user has view_product at this point
+        self.assertEqual(1, len(response.data))
+        self.assertEqual(self.base_user.username, response.data[0]["username"])
+        self.assertIn("view_product", response.data[0]["object_permissions"])
+
+        # Superuser can POST to assign permissions
+        data = {"user": self.admin_user.username, "permissions": ["view_product"]}
+        response = self.client.post(url, data, format="json")
+        self.assertEqual(status.HTTP_200_OK, response.status_code)
+        self.assertEqual({"status": "permissions assigned"}, response.data)
+        self.assertIn("view_product", get_perms(self.admin_user, self.product1))
+
+        # Superuser can DELETE to remove permissions
+        data = {"user": self.admin_user.username, "permissions": ["view_product"]}
+        response = self.client.delete(url, data, content_type="application/json")
+        self.assertEqual(status.HTTP_200_OK, response.status_code)
+        self.assertEqual({"status": "permissions removed"}, response.data)
+        self.assertNotIn("view_product", get_perms(self.admin_user, self.product1))
+
+        # Product creator (created_by) can manage permissions
+        self.product1.created_by = self.admin_user
+        self.product1.save()
+        assign_perm("view_product", self.admin_user, self.product1)
+        self.client.login(username=self.admin_user.username, password="secret")
+        data = {"user": self.base_user.username, "permissions": ["change_product"]}
+        response = self.client.post(url, data, format="json")
+        self.assertEqual(status.HTTP_200_OK, response.status_code)
+        self.assertIn("change_product", get_perms(self.base_user, self.product1))
+
+        # Invalid permission codename returns 400
+        self.client.login(username=self.super_user.username, password="secret")
+        data = {"user": self.base_user.username, "permissions": ["nonexistent_perm"]}
+        response = self.client.post(url, data, format="json")
+        self.assertEqual(status.HTTP_400_BAD_REQUEST, response.status_code)
+        self.assertIn("errors", response.data)
+
+        # Missing required fields returns 400
+        response = self.client.post(url, {}, format="json")
+        self.assertEqual(status.HTTP_400_BAD_REQUEST, response.status_code)
+        self.assertIn("errors", response.data)
+
+        # Empty permissions list returns 400
+        data = {"user": self.base_user.username, "permissions": []}
+        response = self.client.post(url, data, format="json")
+        self.assertEqual(status.HTTP_400_BAD_REQUEST, response.status_code)
+        self.assertIn("errors", response.data)
+
 
 class ProductRelatedAPITestCase(TestCase):
     def setUp(self):