From c17f7eefde2beec6c125e1e462293c49676f151c Mon Sep 17 00:00:00 2001 From: Eliot Berriot Date: Tue, 17 Apr 2018 23:08:15 +0200 Subject: [PATCH] Ensure follower is approved to access library --- api/funkwhale_api/federation/permissions.py | 3 ++- api/tests/federation/test_permissions.py | 17 ++++++++++++++++- 2 files changed, 18 insertions(+), 2 deletions(-) diff --git a/api/funkwhale_api/federation/permissions.py b/api/funkwhale_api/federation/permissions.py index 370328eaa..c6f0660b1 100644 --- a/api/funkwhale_api/federation/permissions.py +++ b/api/funkwhale_api/federation/permissions.py @@ -16,4 +16,5 @@ class LibraryFollower(BasePermission): return False library = actors.SYSTEM_ACTORS['library'].get_actor_instance() - return library.followers.filter(url=actor.url).exists() + return library.received_follows.filter( + approved=True, actor=actor).exists() diff --git a/api/tests/federation/test_permissions.py b/api/tests/federation/test_permissions.py index 1a6977542..9b8683210 100644 --- a/api/tests/federation/test_permissions.py +++ b/api/tests/federation/test_permissions.py @@ -30,11 +30,26 @@ def test_library_follower_actor_non_follower( assert check is False +def test_library_follower_actor_follower_not_approved( + factories, api_request, anonymous_user, settings): + settings.FEDERATION_MUSIC_NEEDS_APPROVAL = True + library = actors.SYSTEM_ACTORS['library'].get_actor_instance() + follow = factories['federation.Follow'](target=library, approved=False) + view = APIView.as_view() + permission = permissions.LibraryFollower() + request = api_request.get('/') + setattr(request, 'user', anonymous_user) + setattr(request, 'actor', follow.actor) + check = permission.has_permission(request, view) + + assert check is False + + def test_library_follower_actor_follower( factories, api_request, anonymous_user, settings): settings.FEDERATION_MUSIC_NEEDS_APPROVAL = True library = actors.SYSTEM_ACTORS['library'].get_actor_instance() - follow = factories['federation.Follow'](target=library) + follow = factories['federation.Follow'](target=library, approved=True) view = APIView.as_view() permission = permissions.LibraryFollower() request = api_request.get('/')