Wikiインポート検証・タスク結果APIにADMIN権限チェックを追加

addons/wiki/tests/test_wiki.py

@@ -1861,11 +1861,21 @@ def test_project_wiki_validate_for_import(self, mock_check_file_object_in_node):
         mock_check_file_object_in_node.return_value = True
         dir_id = self.root_import_folder1._id
         url = self.project.api_url_for('project_wiki_validate_for_import', dir_id=dir_id)
-        res = self.app.get(url)
+        res = self.app.get(url, auth=self.user.auth)
         response_json = res.json
         task_id = response_json['taskId']
         uuid_obj = uuid.UUID(task_id)
         assert uuid_obj
+        task = WikiImportTask.objects.get(task_id=task_id)
+        self.assertEqual(task.node, self.project)
+        self.assertEqual(task.status, WikiImportTask.STATUS_COMPLETED)
+        self.assertIsNotNone(task.process_end)
+        self.assertEqual(
+            WikiImportTask.objects.filter(
+                node=self.project, status=WikiImportTask.STATUS_RUNNING
+            ).count(),
+            0,
+        )
 
     @mock.patch('addons.wiki.utils.check_file_object_in_node')
     def test_project_wiki_validate_for_import_error(self, mock_check_file_object_in_node):
@@ -1875,7 +1885,7 @@ def test_project_wiki_validate_for_import_error(self, mock_check_file_object_in_
         ))
         dir_id = self.root_import_folder1._id
         url = self.project.api_url_for('project_wiki_validate_for_import', dir_id=dir_id)
-        res = self.app.get(url, expect_errors=True)
+        res = self.app.get(url, auth=self.user.auth, expect_errors=True)
         self.assertEqual(res.status_code, 400)
         self.assertEqual(res.json['message_short'], 'directory id does not exist')
         self.assertEqual(res.json['message_long'], 'directory id does not exist')
@@ -1964,6 +1974,9 @@ def test_project_wiki_import(self, mock_check_file_object_in_node, mock_project_
         response_json = res.json
         task_id = response_json['taskId']
         uuid_obj = uuid.UUID(task_id)
+        task = WikiImportTask.objects.get(task_id=task_id)
+        self.assertEqual(task.node, self.project)
+        self.assertEqual(task.status, WikiImportTask.STATUS_RUNNING)
 
     @mock.patch('addons.wiki.utils.check_file_object_in_node')
     def test_project_wiki_import_error(self, mock_check_file_object_in_node):
@@ -1983,6 +1996,43 @@ def test_project_wiki_import_with_no_admin_permission(self):
         res = self.app.post_json(url, { 'data': [{'test': 'test1'}] }, expect_errors=True)
         assert_equal(res.status_code, 401)
 
+    @mock.patch('addons.wiki.views.AsyncResult')
+    def test_project_get_task_result_with_admin_permission(self, mock_async_result):
+        mock_res = mock.MagicMock()
+        mock_res.ready.return_value = True
+        mock_res.get.return_value = {'canStartImport': True, 'data': []}
+        mock_async_result.return_value = mock_res
+        WikiImportTask.objects.create(
+            node=self.project,
+            task_id='task-id',
+            status=WikiImportTask.STATUS_COMPLETED,
+            creator=self.user,
+        )
+        url = self.project.api_url_for('project_get_task_result', task_id='task-id')
+        res = self.app.get(url, auth=self.user.auth)
+        assert_equal(res.status_code, http_status.HTTP_200_OK)
+        assert_equal(res.json, {'canStartImport': True, 'data': []})
+
+    @mock.patch('addons.wiki.views.AsyncResult')
+    def test_project_get_task_result_rejects_task_for_other_node(self, mock_async_result):
+        other_project = ProjectFactory(creator=self.user)
+        WikiImportTask.objects.create(
+            node=other_project,
+            task_id='other-node-task-id',
+            status=WikiImportTask.STATUS_COMPLETED,
+            creator=self.user,
+        )
+        url = self.project.api_url_for('project_get_task_result', task_id='other-node-task-id')
+        res = self.app.get(url, auth=self.user.auth, expect_errors=True)
+        assert_equal(res.status_code, http_status.HTTP_404_NOT_FOUND)
+        mock_async_result.assert_not_called()
+
+    def test_project_get_task_result_rejects_unknown_task_id(self):
+        url = self.project.api_url_for('project_get_task_result', task_id='unknown-task-id')
+        res = self.app.get(url, auth=self.user.auth, expect_errors=True)
+        assert_equal(res.status_code, http_status.HTTP_404_NOT_FOUND)
+
+
     @mock.patch('celery.contrib.abortable.AbortableAsyncResult')
     def test_wiki_import_create_or_update_aborted(self, mock_task):
         mock_task.is_aborted.return_value = True

addons/wiki/tests/test_wiki_import.py

@@ -1245,11 +1245,15 @@ def test_project_wiki_validate_for_import(self, mock_check_file_object_in_node):
         mock_check_file_object_in_node.return_value = True
         dir_id = self.root_import_folder1._id
         url = self.project.api_url_for('project_wiki_validate_for_import', dir_id=dir_id)
-        res = self.app.get(url)
+        res = self.app.get(url, auth=self.user.auth)
         response_json = res.json
         task_id = response_json['taskId']
         uuid_obj = uuid.UUID(task_id)
         assert uuid_obj
+        task = WikiImportTask.objects.get(task_id=task_id)
+        assert_equal(task.node, self.project)
+        assert_equal(task.status, WikiImportTask.STATUS_COMPLETED)
+        assert_is_not_none(task.process_end)
 
     def test_project_wiki_validate_for_import_process(self):
         result = views.project_wiki_validate_for_import_process(
@@ -1323,6 +1327,9 @@ def test_project_wiki_import(self, mock_check_file_object_in_node, mock_project_
         task_id = response_json['taskId']
         uuid_obj = uuid.UUID(task_id)
         assert_is_not_none(uuid_obj)
+        task = WikiImportTask.objects.get(task_id=task_id)
+        assert_equal(task.node, self.project)
+        assert_equal(task.status, WikiImportTask.STATUS_RUNNING)
 
     @mock.patch('addons.wiki.views._get_md_content_from_wb')
     @mock.patch('addons.wiki.views._get_or_create_wiki_folder')

addons/wiki/views.py

@@ -771,12 +771,40 @@ def serialize_component_wiki(node, auth):
         return component
     return None
 
+
+def _bind_wiki_task_to_node(task_id, node, auth, status, set_process_end=False):
+    """Record task_id as belonging to node for get_task_result authorization.
+
+    Validate tasks must not use STATUS_RUNNING so they do not affect
+    "importing" UI, abort, or concurrent-import checks.
+    """
+    defaults = {
+        'node': node,
+        'status': status,
+        'creator': auth.user if auth else None,
+    }
+    if set_process_end:
+        defaults['process_end'] = timezone.make_naive(timezone.now(), timezone.utc)
+    WikiImportTask.objects.get_or_create(task_id=task_id, defaults=defaults)
+
+
+def _wiki_task_belongs_to_node(task_id, node):
+    return WikiImportTask.objects.filter(task_id=task_id, node=node).exists()
+
+
 @must_be_valid_project
-def project_wiki_validate_for_import(dir_id, node, **kwargs):
+@must_have_permission(ADMIN)
+@must_not_be_registration
+@must_have_addon('wiki', 'node')
+def project_wiki_validate_for_import(dir_id, auth, node, **kwargs):
     wiki_utils.check_file_object_in_node(dir_id, node)
     node_id = node.guids.first()._id
     task = tasks.run_project_wiki_validate_for_import.delay(dir_id, node_id)
     task_id = task.id
+    # Completed + process_end: ownership only; not treated as a running import.
+    _bind_wiki_task_to_node(
+        task_id, node, auth, WikiImportTask.STATUS_COMPLETED, set_process_end=True
+    )
     return {'taskId': task_id}
 
 def project_wiki_validate_for_import_process(dir_id, node):
@@ -904,11 +932,15 @@ def project_wiki_import(dir_id, auth, node, **kwargs):
     data_json = json.dumps(data)
     task = tasks.run_project_wiki_import.delay(data_json, dir_id, current_user_id, node_id)
     task_id = task.id
+    # Bind before returning so polling get_task_result does not race the worker.
+    _bind_wiki_task_to_node(task_id, node, auth, WikiImportTask.STATUS_RUNNING)
+    check_running_task(task_id, node)
     return {'taskId': task_id}
 
 def project_wiki_import_process(data, dir_id, task_id, auth, node):
     logger.info('----WIKI IMPORT DIRECTORY_ID: {}, PROJECT_NAME: {} ----'.format(dir_id, node.title))
-    WikiImportTask.objects.create(node=node, task_id=task_id, status=WikiImportTask.STATUS_RUNNING, creator=auth.user)
+    # May already exist if project_wiki_import bound the task before the worker ran.
+    _bind_wiki_task_to_node(task_id, node, auth, WikiImportTask.STATUS_RUNNING)
     check_running_task(task_id, node)
     ret = []
     wiki_id_list = []
@@ -1306,8 +1338,15 @@ def _create_import_error_list(wiki_infos, imported_list):
     return import_errors
 
 @must_be_valid_project
+@must_have_permission(ADMIN)
+@must_not_be_registration
 @must_have_addon('wiki', 'node')
 def project_get_task_result(task_id, node, **kwargs):
+    if not _wiki_task_belongs_to_node(task_id, node):
+        raise HTTPError(http_status.HTTP_404_NOT_FOUND, data=dict(
+            message_short='Not found',
+            message_long='Task not found.',
+        ))
     res = AsyncResult(task_id, app=celery_app)
     result = None
     if not res.ready():