From facd5abf7358839503f9189e8fce99cf6453f4f7 Mon Sep 17 00:00:00 2001 From: wei-kuochen Date: Tue, 29 Sep 2026 13:24:28 +0900 Subject: [PATCH 1/2] fix widget permission issue (No. 290, 303, 304) --- modules/weko-gridlayout/weko_gridlayout/views.py | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/modules/weko-gridlayout/weko_gridlayout/views.py b/modules/weko-gridlayout/weko_gridlayout/views.py index e83d4fbbda..3bd2cff50e 100644 --- a/modules/weko-gridlayout/weko_gridlayout/views.py +++ b/modules/weko-gridlayout/weko_gridlayout/views.py @@ -21,6 +21,9 @@ from sqlalchemy.orm.exc import NoResultFound from werkzeug.exceptions import NotFound from invenio_db import db +from weko_accounts.utils import roles_required +from weko_admin.config import WEKO_ADMIN_PERMISSION_ROLE_REPO, \ + WEKO_ADMIN_PERMISSION_ROLE_SYSTEM, WEKO_ADMIN_PERMISSION_ROLE_COMMUNITY from .api import WidgetItems from .config import WEKO_GRIDLAYOUT_ACCESS_COUNTER_TYPE @@ -296,6 +299,9 @@ def delete_widget_design_page(): @blueprint_api.route('/load_widget_type', methods=['GET']) @login_required +@roles_required([WEKO_ADMIN_PERMISSION_ROLE_SYSTEM, + WEKO_ADMIN_PERMISSION_ROLE_REPO, + WEKO_ADMIN_PERMISSION_ROLE_COMMUNITY]) def load_widget_type(): """Get Widget Type List.""" results = get_widget_type_list() @@ -592,6 +598,9 @@ def upload_file(community_id): @blueprint.route('/widget/uploaded//', methods=["GET"] ) +@roles_required([WEKO_ADMIN_PERMISSION_ROLE_SYSTEM, + WEKO_ADMIN_PERMISSION_ROLE_REPO, + WEKO_ADMIN_PERMISSION_ROLE_COMMUNITY]) def uploaded_file(filename, community_id=0): """Get widget static file. From 894f70f934ea8abe74c51afd1ea733dde66dec0c Mon Sep 17 00:00:00 2001 From: wei-kuochen Date: Tue, 29 Sep 2026 13:41:39 +0900 Subject: [PATCH 2/2] add test code --- modules/weko-gridlayout/tests/test_views.py | 33 ++++++++++++++++++--- 1 file changed, 29 insertions(+), 4 deletions(-) diff --git a/modules/weko-gridlayout/tests/test_views.py b/modules/weko-gridlayout/tests/test_views.py index aa7932184f..b5263c4217 100644 --- a/modules/weko-gridlayout/tests/test_views.py +++ b/modules/weko-gridlayout/tests/test_views.py @@ -463,13 +463,21 @@ def test_delete_widget_design_page(client, users): # def load_widget_type(): -def test_load_widget_type(client, users): - login_user_via_session(client=client, email=users[2]['obj'].email) +user_results2 = [ + (0, 403), + (1, 200), + (2, 200), + (3, 200), + (4, 403), +] +@pytest.mark.parametrize('id, status_code', user_results2) +def test_load_widget_type(client, users, id, status_code): + login_user_via_session(client=client, email=users[id]['obj'].email) res = client.get( url_for("weko_gridlayout_api.load_widget_type"), headers={"Content-Type": "application/json"} ) - assert res.status_code == 200 + assert res.status_code == status_code # def save_widget_item(): @@ -838,6 +846,24 @@ def test_upload_file(client, users, communities): # def uploaded_file(filename, community_id=0): +user_results2 = [ + (0, 403), + (1, 200), + (2, 200), + (3, 403), + (4, 403), +] +@pytest.mark.parametrize('id, status_code', user_results2) +def test_uploaded_file(client, users, id, status_code): + login_user_via_session(client=client, email=users[id]["email"]) + with patch('weko_gridlayout.views.WidgetBucket.get_file', return_value="test"): + res = client.get( + url_for("weko_gridlayout.uploaded_file", community_id="Root Index", filename="file") + ) + assert res.status_code == status_code + assert res.get_data(as_text=True) == "test" + + def test_uploaded_file(client, communities): # The view returns whatever get_file() gives it, so the stand-in has to be # something Flask can turn into a response - a function is not. @@ -848,7 +874,6 @@ def test_uploaded_file(client, communities): assert res.status_code == 200 assert res.get_data(as_text=True) == "test" - # def unlocked_widget(): def test_unlocked_widget(client, users): login_user_via_session(client=client, email=users[2]["email"])