Merge pull request #27 from bugout-dev/fix-resource-acl-groups

Use defined rows instead of hybrid property for query filter

Author: zomglings

brood/resources/actions.py

@@ -41,8 +41,8 @@ def acl_auth(
         .filter(models.ResourceHolderPermission.resource_id == resource_id)
         .filter(
             or_(
-                models.ResourceHolderPermission.holder_id == user_id,
-                models.ResourceHolderPermission.holder_id.in_(user_group_id_list),
+                models.ResourceHolderPermission.user_id == user_id,
+                models.ResourceHolderPermission.group_id.in_(user_group_id_list),
             )
         )
         .all()

brood/resources/api.py

@@ -214,7 +214,7 @@ async def update_resource_handler(
     - **drop_keys** (list): List of keys to drop
     """
     ensure_resource_permission(
-        db_session, current_user.id, resource_id, {data.ResourcePermissions.ADMIN},
+        db_session, current_user.id, resource_id, {data.ResourcePermissions.UPDATE},
     )
     try:
         updated_resource = actions.update_resource_data(

brood/resources/models.py

@@ -11,7 +11,6 @@
 )
 from sqlalchemy.orm import relationship
 from sqlalchemy.dialects.postgresql import JSONB, UUID
-from sqlalchemy.ext.hybrid import hybrid_property
 
 from ..models import utcnow, User, Group, Application
 
@@ -125,12 +124,3 @@ class ResourceHolderPermission(Base):  # type: ignore
         onupdate=utcnow(),
         nullable=False,
     )
-
-    @hybrid_property
-    def holder_id(self):
-        if self.user_id is not None:
-            return self.user_id
-        elif self.group_id is not None:
-            return self.group_id
-        else:
-            return None