diff --git a/posthog/api/notebook.py b/posthog/api/notebook.py index 83b2e32e976c3..a0dd84c359b6c 100644 --- a/posthog/api/notebook.py +++ b/posthog/api/notebook.py @@ -34,6 +34,7 @@ from posthog.models.notebook.notebook import Notebook from posthog.models.utils import UUIDT from posthog.rbac.access_control_api_mixin import AccessControlViewSetMixin +from posthog.rbac.user_access_control import UserAccessControlSerializerMixin from posthog.utils import relative_date_parse from loginas.utils import is_impersonated_session @@ -94,7 +95,7 @@ class Meta: read_only_fields = fields -class NotebookSerializer(NotebookMinimalSerializer): +class NotebookSerializer(NotebookMinimalSerializer, UserAccessControlSerializerMixin): class Meta: model = Notebook fields = [ @@ -109,6 +110,7 @@ class Meta: "created_by", "last_modified_at", "last_modified_by", + "user_access_level", ] read_only_fields = [ "id", @@ -117,6 +119,7 @@ class Meta: "created_by", "last_modified_at", "last_modified_by", + "user_access_level", ] def create(self, validated_data: Dict, *args, **kwargs) -> Notebook: diff --git a/posthog/rbac/user_access_control.py b/posthog/rbac/user_access_control.py index d906802578236..6bab3c3cc67e1 100644 --- a/posthog/rbac/user_access_control.py +++ b/posthog/rbac/user_access_control.py @@ -1,6 +1,7 @@ from functools import cached_property from django.db.models import Model, Q, QuerySet -from typing import TYPE_CHECKING, List, Optional +from rest_framework import serializers +from typing import TYPE_CHECKING, List, Optional, cast from posthog.constants import AvailableFeature from posthog.models import ( @@ -205,3 +206,16 @@ def filter_queryset_by_access_level(self, queryset: QuerySet) -> QuerySet: # ) return queryset + + +class UserAccessControlSerializerMixin(serializers.Serializer): + user_access_level = serializers.SerializerMethodField( + read_only=True, + help_text="The effective access level the user has for this object", + ) + + def get_user_access_level(self, obj: Model) -> Optional[str]: + access_control = cast(UserAccessControl, self.context["view"].user_access_control).access_control_for_object( + obj + ) + return access_control.access_level if access_control else None