Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Per object checks on List/Create methods fail with 'pk' required #106

Open
nhi-vanye opened this issue Oct 6, 2024 · 1 comment
Open

Comments

@nhi-vanye
Copy link

I have a policy that controls who can create of list objects

{
            "action": ["<method:get>"],
            "principal": "*",
            "effect": "allow",
            "condition_expression": ["(user_is_assessor or user_is_target or user_is_requestor or user_is_hr)"]
}

Where user_is_assessor is

    def user_is_assessor(self, request, view, action) -> bool:
        obj = view.get_object()
        return obj.assessor.user.username == request.user.username

(The goal being to check the "owner" of the object (assessor) is listing/creating child objects.

view.get_object() is throwing an error that I haven't supplied a pk

(AssertionError: Expected view AssessmentListView to be called with a URL keyword argument named "pk". Fix your URL conf, or set the .lookup_field attribute on the view correctly.)

Which is correct as this is a list view not a detail view.

(I'm using generics hence the use of `method:get' rather that 'list')

@nhi-vanye
Copy link
Author

I guess another way around the issue is to check the permissions of the parent object i.e. the resource/view in which the object is being created.

Not sure how to get that "view" in order to call "<PARENTVIEW>.get_object()"

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant