From ad2342a08b680aef6154e09ed8307fab647dd459 Mon Sep 17 00:00:00 2001
From: Olivia Rodriguez Valdes <olicubalibre@gmail.com>
Date: Fri, 1 Mar 2019 12:40:54 -0500
Subject: [PATCH 1/3] Verify there is a viewer on context
---
graphene_django/utils.py | 3 +++
1 file changed, 3 insertions(+)
diff --git a/graphene_django/utils.py b/graphene_django/utils.py
index 55581c4..f4800eb 100644
--- a/graphene_django/utils.py
+++ b/graphene_django/utils.py
@@ -122,7 +122,10 @@ def auth_resolver(parent_resolver, permissions, raise_exception, root, info, **a
:return: Resolved field. None if the viewer does not have permission to access the field.
"""
# Get viewer from context
+ if not hasattr(info.context, 'user'):
+ raise PermissionDenied()
user = info.context.user
+
if has_permissions(user, permissions):
if parent_resolver:
# A resolver is provided in the class
From 76cbad1fb21530ad081c73f7a64c0b95dcc935e1 Mon Sep 17 00:00:00 2001
From: Olivia Rodriguez Valdes <olicubalibre@gmail.com>
Date: Fri, 1 Mar 2019 12:42:29 -0500
Subject: [PATCH 2/3] Change DjangoField to PermissionField
---
graphene_django/fields.py | 4 ++--
graphene_django/tests/test_fields.py | 8 ++++----
2 files changed, 6 insertions(+), 6 deletions(-)
diff --git a/graphene_django/fields.py b/graphene_django/fields.py
index 1bfd33a..25eb419 100644
--- a/graphene_django/fields.py
+++ b/graphene_django/fields.py
@@ -154,12 +154,12 @@ class DjangoConnectionField(ConnectionField):
)
-class DjangoField(Field):
+class PermissionField(Field):
"""Class to manage permission for fields"""
def __init__(self, type, permissions, permissions_resolver=auth_resolver, *args, **kwargs):
"""Get permissions to access a field"""
- super(DjangoField, self).__init__(type, *args, **kwargs)
+ super(PermissionField, self).__init__(type, *args, **kwargs)
self.permissions = permissions
self.permissions_resolver = permissions_resolver
diff --git a/graphene_django/tests/test_fields.py b/graphene_django/tests/test_fields.py
index 95ccb64..23cce7f 100644
--- a/graphene_django/tests/test_fields.py
+++ b/graphene_django/tests/test_fields.py
@@ -1,6 +1,6 @@
from unittest import TestCase
from django.core.exceptions import PermissionDenied
-from graphene_django.fields import DjangoField
+from graphene_django.fields import PermissionField
class MyInstance(object):
@@ -10,11 +10,11 @@ class MyInstance(object):
return "resolver method"
-class DjangoPermissionFieldTests(TestCase):
+class PermissionFieldTests(TestCase):
def test_permission_field(self):
MyType = object()
- field = DjangoField(MyType, permissions=['perm1', 'perm2'], source='resolver')
+ field = PermissionField(MyType, permissions=['perm1', 'perm2'], source='resolver')
resolver = field.get_resolver(None)
class Viewer(object):
@@ -30,7 +30,7 @@ class DjangoPermissionFieldTests(TestCase):
def test_permission_field_without_permission(self):
MyType = object()
- field = DjangoField(MyType, permissions=['perm1', 'perm2'], source='resolver')
+ field = PermissionField(MyType, permissions=['perm1', 'perm2'], source='resolver')
resolver = field.get_resolver(field.resolver)
class Viewer(object):
From 8912175cc5393be4619513b78be9cc8458813da3 Mon Sep 17 00:00:00 2001
From: Olivia Rodriguez Valdes <olicubalibre@gmail.com>
Date: Fri, 1 Mar 2019 12:44:52 -0500
Subject: [PATCH 3/3] Set permissions as optional
---
graphene_django/fields.py | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/graphene_django/fields.py b/graphene_django/fields.py
index 25eb419..bbf1940 100644
--- a/graphene_django/fields.py
+++ b/graphene_django/fields.py
@@ -157,7 +157,7 @@ class DjangoConnectionField(ConnectionField):
class PermissionField(Field):
"""Class to manage permission for fields"""
- def __init__(self, type, permissions, permissions_resolver=auth_resolver, *args, **kwargs):
+ def __init__(self, type, permissions=(), permissions_resolver=auth_resolver, *args, **kwargs):
"""Get permissions to access a field"""
super(PermissionField, self).__init__(type, *args, **kwargs)
self.permissions = permissions
@@ -165,5 +165,7 @@ class PermissionField(Field):
def get_resolver(self, parent_resolver):
"""Intercept resolver to analyse permissions"""
- return partial(get_unbound_function(self.permissions_resolver), self.resolver or parent_resolver,
- self.permissions, True)
+ parent_resolver = super(PermissionField, self).get_resolver(parent_resolver)
+ if self.permissions:
+ return partial(get_unbound_function(self.permissions_resolver), parent_resolver, self.permissions, True)
+ return parent_resolver