refine the code

Signed-off-by: tdruez <tdruez@aboutcode.org>

Author: tdruez

dje/api.py

@@ -411,18 +411,19 @@ def get_queryset(self):
 
         # Support for `many=True`
         serializer_field = self.parent if isinstance(self.parent, ManyRelatedField) else self
-
-        model_class = serializer_field.parent.Meta.model
-        field_name = serializer_field.source
-        field = model_class._meta.get_field(field_name)
         user = self.context["request"].user
 
-        if not queryset:
-            manager = field.related_model.objects
-            if is_secured(manager):
-                queryset = manager.get_queryset(user=user)
-            else:
-                queryset = manager.all()
+        if not queryset or self.scope_content_type:
+            model_class = serializer_field.parent.Meta.model
+            field_name = serializer_field.source
+            field = model_class._meta.get_field(field_name)
+
+            if not queryset:
+                manager = field.related_model.objects
+                if is_secured(manager):
+                    queryset = manager.get_queryset(user=user)
+                else:
+                    queryset = manager.all()
 
         queryset = queryset.scope(user.dataspace)
 

dje/api_permissions.py

@@ -6,6 +6,7 @@
 # See https://aboutcode.org for more information about AboutCode FOSS projects.
 #
 
+
 from django.contrib.auth import get_user_model
 from django.core.exceptions import ObjectDoesNotExist
 
@@ -20,6 +21,8 @@
 from rest_framework.decorators import action
 from rest_framework.response import Response
 
+from dje.api import DataspacedSlugRelatedField
+
 User = get_user_model()
 
 
@@ -49,16 +52,11 @@ class ObjectPermissionSerializer(serializers.Serializer):
     """
     Generic serializer for representing or updating object-level permissions.
     Accepts:
-      - user: user ID
+      - user: username
       - permissions: list of permission codenames
     """
 
-    # TODO: Scope by dataspace, see DataspacedSlugRelatedField
-    user = serializers.SlugRelatedField(
-        queryset=User.objects.all(),
-        slug_field="username",
-    )
-    # user = DataspacedSlugRelatedField(slug_field="username")
+    user = DataspacedSlugRelatedField(queryset=User.objects.all(), slug_field="username")
     permissions = serializers.ListField(child=serializers.CharField(), allow_empty=False)
 
     class Meta:
@@ -101,12 +99,11 @@ def manage_permissions(self, request, *args, **kwargs):
         Manage object-level permissions for this object.
 
         - GET: List users and their permissions.
-        - POST: Assign permissions to a user. Provide `user` ID and `permissions` list.
-        - DELETE: Remove permissions from a user. Provide `user` ID and `permissions`
-          list.
+        - POST: Assign permissions to a user. Provide `user` and `permissions` list.
+        - DELETE: Remove permissions from a user. Provide `user` and `permissions` list.
         """
         obj = self.get_object()
-        serializer_context = {"object": obj}
+        serializer_context = {**self.get_serializer_context(), "object": obj}
 
         if request.method == "GET":
             users_with_perms = get_users_with_perms(obj, attach_perms=True)
@@ -128,8 +125,8 @@ def manage_permissions(self, request, *args, **kwargs):
             for perm in perms:
                 try:
                     assign_perm(perm, user, obj)
-                except ObjectDoesNotExist as e:
-                    errors.append(f"Cannot assign permission '{perm}': {str(e)}")
+                except ObjectDoesNotExist:
+                    errors.append(f"Cannot assign permission '{perm}' due to an internal error.")
 
             if errors:
                 return Response({"errors": errors}, status=status.HTTP_400_BAD_REQUEST)
@@ -141,8 +138,8 @@ def manage_permissions(self, request, *args, **kwargs):
             for perm in perms:
                 try:
                     remove_perm(perm, user, obj)
-                except ObjectDoesNotExist as e:
-                    errors.append(f"Cannot remove permission '{perm}': {str(e)}")
+                except ObjectDoesNotExist:
+                    errors.append(f"Cannot assign permission '{perm}' due to an internal error.")
 
             if errors:
                 return Response({"errors": errors}, status=status.HTTP_400_BAD_REQUEST)

product_portfolio/tests/test_api.py

@@ -650,6 +650,13 @@ def test_api_product_endpoint_manage_permissions_action(self):
         self.assertEqual(status.HTTP_400_BAD_REQUEST, response.status_code)
         self.assertIn("errors", response.data)
 
+        # User from another dataspace is rejected (dataspace scoping)
+        other_dataspace_user = create_user("other_ds_user", self.alternate_dataspace)
+        data = {"user": other_dataspace_user.username, "permissions": ["view_product"]}
+        response = self.client.post(url, data, format="json")
+        self.assertEqual(status.HTTP_400_BAD_REQUEST, response.status_code)
+        self.assertIn("errors", response.data)
+
 
 class ProductRelatedAPITestCase(TestCase):
     def setUp(self):