diff options
| author | Fabian Mastenbroek <mail.fabianm@gmail.com> | 2021-07-02 16:47:40 +0200 |
|---|---|---|
| committer | Fabian Mastenbroek <mail.fabianm@gmail.com> | 2021-07-02 18:09:58 +0200 |
| commit | fa7ffd9d1594a5bc9dba4fc65af0a4100988341b (patch) | |
| tree | e3ce768109e3cb02a4ae4bfb9cda32ebf0e066e2 /opendc-web/opendc-web-api/opendc/api/scenarios.py | |
| parent | a2a5979bfb392565b55e489b6020aa391e782eb0 (diff) | |
api: Restrict API scopes
This change adds support for restricting API scopes in the OpenDC API
server. This is necessary to make a distinction between runners and
regular users.
Diffstat (limited to 'opendc-web/opendc-web-api/opendc/api/scenarios.py')
| -rw-r--r-- | opendc-web/opendc-web-api/opendc/api/scenarios.py | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/opendc-web/opendc-web-api/opendc/api/scenarios.py b/opendc-web/opendc-web-api/opendc/api/scenarios.py index 234bdec1..eacb0b49 100644 --- a/opendc-web/opendc-web-api/opendc/api/scenarios.py +++ b/opendc-web/opendc-web-api/opendc/api/scenarios.py @@ -24,7 +24,7 @@ from marshmallow import Schema, fields from opendc.models.scenario import Scenario as ScenarioModel, ScenarioSchema from opendc.models.portfolio import Portfolio -from opendc.exts import current_user, requires_auth +from opendc.exts import current_user, requires_auth, has_scope class Scenario(Resource): @@ -37,7 +37,11 @@ class Scenario(Resource): """Get scenario by identifier.""" scenario = ScenarioModel.from_id(scenario_id) scenario.check_exists() - scenario.check_user_access(current_user['sub'], False) + + # Users with scope runner can access all scenarios + if not has_scope('runner'): + scenario.check_user_access(current_user['sub'], False) + data = ScenarioSchema().dump(scenario.obj) return {'data': data} |