[Fixes #14152] Restrict the creation of remote resources to administrators only by default#14156
[Fixes #14152] Restrict the creation of remote resources to administrators only by default#14156
Conversation
…ators only by default
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a new permission mechanism to control the addition of remote resources across documents, services, and datasets. It implements a synthetic permission, add_remote_resource, which is governed by the new REGISTERED_USERS_CAN_ADD_REMOTE_RESOURCES setting. The changes include integration of permission checks in the respective views and API endpoints, along with extensive unit tests. Feedback was provided to enhance test coverage by explicitly verifying database state after successful resource creation.
|
|
||
| response = self.client.post(reverse("document_upload"), data=form_data) | ||
| self.assertEqual(response.status_code, 302) | ||
|
|
There was a problem hiding this comment.
To make this test more robust, it's a good practice to also verify that the document has been successfully created in the database, not just that the request resulted in a redirect.
| self.assertTrue(Document.objects.filter(title=title).exists()) |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #14156 +/- ##
==========================================
- Coverage 74.62% 74.61% -0.02%
==========================================
Files 958 958
Lines 57891 58134 +243
Branches 7889 7943 +54
==========================================
+ Hits 43202 43375 +173
- Misses 12927 12994 +67
- Partials 1762 1765 +3 🚀 New features to boost your workflow:
|
|
|
||
| @login_required | ||
| def register_service(request): | ||
| check_add_remote_resource_perm(request.user) |
There was a problem hiding this comment.
@nrjadkry I think this check should go under the POST case
There was a problem hiding this comment.
my fault @nrjadkry I thought it was another section of the UI. Of course we don't want to present the form to non-admins by default.
Forget it.
2 participants
Fixes #14152
Checklist
For all pull requests:
The following are required only for core and extension modules (they are welcomed, but not required, for contrib modules):
Submitting the PR does not require you to check all items, but by the time it gets merged, they should be either satisfied or inapplicable.