diff --git a/openedx_tagging/core/tagging/models/base.py b/openedx_tagging/core/tagging/models/base.py index 5fcdcb33..d23cb8a4 100644 --- a/openedx_tagging/core/tagging/models/base.py +++ b/openedx_tagging/core/tagging/models/base.py @@ -347,7 +347,6 @@ def add_tag( tag_value: str, parent_tag_id: int | None = None, external_id: str | None = None - ) -> Tag: """ Add new Tag to Taxonomy. If an existing Tag with the `tag_value` already diff --git a/openedx_tagging/core/tagging/rest_api/v1/permissions.py b/openedx_tagging/core/tagging/rest_api/v1/permissions.py index df2a7034..b63a6b7e 100644 --- a/openedx_tagging/core/tagging/rest_api/v1/permissions.py +++ b/openedx_tagging/core/tagging/rest_api/v1/permissions.py @@ -4,6 +4,8 @@ import rules # type: ignore[import] from rest_framework.permissions import DjangoObjectPermissions +from ...models import Tag + class TaxonomyObjectPermissions(DjangoObjectPermissions): """ @@ -54,4 +56,5 @@ def has_object_permission(self, request, view, obj): """ Returns True if the user on the given request is allowed the given view for the given object. """ + obj = obj.taxonomy if isinstance(obj, Tag) else obj return rules.has_perm("oel_tagging.list_tag", request.user, obj) diff --git a/openedx_tagging/core/tagging/rules.py b/openedx_tagging/core/tagging/rules.py index bb22b2de..97ca56de 100644 --- a/openedx_tagging/core/tagging/rules.py +++ b/openedx_tagging/core/tagging/rules.py @@ -57,11 +57,10 @@ def can_view_tag(user: UserType, tag: Tag | None = None) -> bool: User can view tags for any taxonomy they can view. """ taxonomy = tag.taxonomy.cast() if (tag and tag.taxonomy) else None - has_perm_thing = user.has_perm( + return user.has_perm( "oel_tagging.view_taxonomy", taxonomy, ) - return has_perm_thing @rules.predicate diff --git a/tests/openedx_tagging/core/tagging/test_rules.py b/tests/openedx_tagging/core/tagging/test_rules.py index f30cbd27..11cc2ced 100644 --- a/tests/openedx_tagging/core/tagging/test_rules.py +++ b/tests/openedx_tagging/core/tagging/test_rules.py @@ -141,12 +141,12 @@ def test_add_change_tag(self, perm): ) def test_tag_free_text_taxonomy(self, perm): """ - Taxonomy administrators cannot modify tags on a free-text Taxonomy + Taxonomy administrators can modify any Tag, even those associated with a free-text Taxonomy """ self.taxonomy.allow_free_text = True self.taxonomy.save() assert self.superuser.has_perm(perm, self.bacteria) - assert not self.staff.has_perm(perm, self.bacteria) + assert self.staff.has_perm(perm, self.bacteria) assert not self.learner.has_perm(perm, self.bacteria) @ddt.data(