Skip to content

Commit 10e84e3

Browse files
authored
[ENG-8524] Update permissions for write preprint contributors (#11272)
* Update permissions for write preprint contributors * Remove duplicate code
1 parent a2281c9 commit 10e84e3

1 file changed

Lines changed: 11 additions & 3 deletions

File tree

api/actions/permissions.py

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -46,12 +46,20 @@ def has_object_permission(self, request, view, obj):
4646
else:
4747
# Moderators and node admins can trigger state changes.
4848
is_node_admin = target is not None and target.has_permission(auth.user, osf_permissions.ADMIN)
49-
if not (is_node_admin or auth.user.has_perm('view_submissions', provider)):
50-
return False
49+
is_write_contributor = target is not None and target.has_permission(auth.user, osf_permissions.WRITE)
5150

52-
# User can trigger state changes on this reviewable, but can they use this trigger in particular?
51+
# Validate serializer once and extract trigger
5352
serializer = view.get_serializer(data=request.data)
5453
serializer.is_valid(raise_exception=True)
5554
trigger = serializer.validated_data.get('trigger')
55+
56+
provisional_write_allowed = is_write_contributor and trigger == ReviewTriggers.SUBMIT.value
57+
58+
if not (is_node_admin or auth.user.has_perm('view_submissions', provider) or provisional_write_allowed):
59+
return False
60+
61+
# User can trigger state changes on this reviewable, but can they use this trigger in particular?
5662
permission = TRIGGER_PERMISSIONS[trigger]
63+
if permission is None and is_write_contributor and trigger == ReviewTriggers.SUBMIT.value:
64+
return True
5765
return permission is None or request.user.has_perm(permission, target.provider)

0 commit comments

Comments
 (0)