Fixed bug w/ not checking permissions in copy

biblib/tests/unit_tests/test_webservices.py

@@ -718,7 +718,7 @@ def test_operations_view_post_types(self):
         self.assertEqual(response.json['error'], NO_LIBRARY_SPECIFIED_ERROR['body'])
 
         post_data['action'] = 'copy'
-        post_data['libraries'] = ['lib1', 'lib2']
+        post_data['libraries'] = [library_id_2, library_id_2]
         response = self.client.post(
             url,
             data=json.dumps(post_data),

biblib/views/base_view.py

@@ -28,6 +28,9 @@ class BaseView(Resource):
     #default permissions for write_access()
     write_allowed = ['write', 'admin', 'owner']
 
+    # default permissions for read_access()
+    read_allowed = ['read', 'write', 'admin', 'owner']
+
     @staticmethod
     def helper_uuid_to_slug(library_uuid):
         """
@@ -222,8 +225,27 @@ def delete_access(cls, service_uid, library_id):
         delete_allowed = cls.helper_access_allowed(service_uid=service_uid,
                                                    library_id=library_id,
                                                    access_type='owner')
-        return delete_allowed 
-
+        return delete_allowed
+
+    @classmethod
+    def read_access(cls, service_uid, library_id):
+        """
+        Defines which type of user has read permissions to a library.
+
+        :param service_uid: the user ID within this microservice
+        :param library_id: the unique ID of the library
+
+        :return: boolean, access (True), no access (False)
+        """
+
+        for access_type in cls.read_allowed:
+            if cls.helper_access_allowed(service_uid=service_uid,
+                                         library_id=library_id,
+                                         access_type=access_type):
+                return True
+
+        return False
+
     @classmethod
     def write_access(cls, service_uid, library_id):
         """

biblib/views/operations_view.py

@@ -173,7 +173,7 @@ def post(self, library):
           - admin
           - write
         """
-
+        
         # Get the user requesting this from the header
         try:
             user_editing = self.helper_get_user_id()
@@ -203,22 +203,8 @@ def post(self, library):
             current_app.logger.error('Wrong type passed for POST: {0} [{1}]'
                                      .format(request.data, error))
             return err(WRONG_TYPE_ERROR)
-
-        if data['action'] in ['union', 'intersection', 'difference']:
-            if 'libraries' not in data:
-                return err(NO_LIBRARY_SPECIFIED_ERROR)
-            if 'name' not in data:
-                data['name'] = 'Untitled {0}.'.format(get_date().isoformat())
-            if 'public' not in data:
-                data['public'] = False
-
-        if data['action'] == 'copy':
-            if 'libraries' not in data:
-                return err(NO_LIBRARY_SPECIFIED_ERROR)
-            if len(data['libraries']) > 1:
-                return err(TOO_MANY_LIBRARIES_SPECIFIED_ERROR)
-
         lib_names = []
+        check_access = []
         with current_app.session_scope() as session:
             primary = session.query(Library).filter_by(id=library_uuid).one()
             lib_names.append(primary.name)
@@ -230,6 +216,32 @@ def post(self, library):
                         return err(BAD_LIBRARY_ID_ERROR)
                     secondary = session.query(Library).filter_by(id=secondary_uuid).one()
                     lib_names.append(secondary.name)
+                    check_access.append(secondary)
+
+            if data['action'] in ['union', 'intersection', 'difference']:
+                if 'libraries' not in data:
+                    return err(NO_LIBRARY_SPECIFIED_ERROR)
+                for lib in check_access:
+                    lib = session.merge(lib)
+                    if lib.public or not self.read_access(service_uid=user_editing_uid,
+                                            library_id=lib.id):
+                        return err(NO_PERMISSION_ERROR)
+                if 'name' not in data:
+                    data['name'] = 'Untitled {0}.'.format(get_date().isoformat())
+                if 'public' not in data:
+                    data['public'] = False
+
+            if data['action'] == 'copy':
+                if 'libraries' not in data:
+                    return err(NO_LIBRARY_SPECIFIED_ERROR)
+                if len(data['libraries']) > 1:
+                    return err(TOO_MANY_LIBRARIES_SPECIFIED_ERROR)
+                # Check the permissions of the user
+                if not self.write_access(service_uid=user_editing_uid,
+                                        library_id=check_access[0].id):
+                    return err(NO_PERMISSION_ERROR)
+
+
 
         if data['action'] == 'union':
             bib_union = self.setops_libraries(