udata 9.1.5.dev31446__py2.py3-none-any.whl → 9.1.5.dev31465__py2.py3-none-any.whl

tasks/__init__.py

@@ -197,7 +197,7 @@ def qa(ctx):
 def serve(ctx, host="localhost", port="7000"):
     """Run a development server"""
     with ctx.cd(ROOT):
-        ctx.run(f"python manage.py serve -d -r -h {host} -p {port}")
+        ctx.run(f"python manage.py serve -d -r -h {host} -p {port}", pty=True)
 
 
 @task

udata/api_fields.py

@@ -302,7 +302,11 @@ def generate_fields(**kwargs):
             parser.add_argument("q", type=str, location="args")
 
         for filterable in filterables:
-            parser.add_argument(filterable["key"], type=filterable["type"], location="args")
+            parser.add_argument(
+                filterable["key"],
+                type=filterable["type"],
+                location="args",
+            )
 
         cls.__index_parser__ = parser
 

udata/core/owned.py

@@ -24,6 +24,22 @@ class OwnedQuerySet(UDataQuerySet):
             qs |= Q(owner=owner) | Q(organization=owner)
         return self(qs)
 
+    def visible_by_user(self, user: User, visible_query: Q):
+        """Return EVERYTHING visible to the user."""
+        if user.is_anonymous:
+            return self(visible_query)
+
+        if user.sysadmin:
+            return self()
+
+        owners: list[User | Organization] = list(user.organizations) + [user.id]
+        # We create a new queryset because we want a pristine self._query_obj.
+        owned_qs: OwnedQuerySet = self.__class__(self._document, self._collection_obj).owned_by(
+            *owners
+        )
+
+        return self(visible_query | owned_qs._query_obj)
+
 
 def check_owner_is_current_user(owner):
     from udata.auth import admin_permission, current_user

udata/core/reuse/api.py

@@ -99,8 +99,9 @@ class ReuseListAPI(API):
     @api.expect(Reuse.__index_parser__)
     @api.marshal_with(Reuse.__page_fields__)
     def get(self):
-        query = Reuse.objects(deleted=None, private__ne=True)
-
+        query = Reuse.objects.visible_by_user(
+            current_user, mongoengine.Q(private__ne=True, deleted=None)
+        )
         return Reuse.apply_sort_filters_and_pagination(query)
 
     @api.secure

udata/core/reuse/models.py

@@ -104,7 +104,7 @@ class Reuse(db.Datetimed, WithMetrics, BadgeMixin, Owned, db.Document):
     )
     # badges = db.ListField(db.EmbeddedDocumentField(ReuseBadge))
 
-    private = field(db.BooleanField(default=False))
+    private = field(db.BooleanField(default=False), filterable={})
 
     ext = db.MapField(db.GenericEmbeddedDocumentField())
     extras = field(db.ExtrasField())