maziggy
4c79563630
fix(auth): API keys with Manage Library can curate library files ( #1832 )
...
require_ownership_permission gates API keys on `all_perm` only — the
comment at auth.py:1659 says OWN and ALL "both map to the same scope
flag" for queue / archives / etc., so checking `all_perm` is the
correct gate. Library deliberately broke that: LIBRARY_UPDATE_OWN /
LIBRARY_DELETE_OWN mapped to can_manage_library, but the ALL variants
were in _APIKEY_DENIED_PERMISSIONS. Result — every API-key request to
DELETE /library/files/{id}, PUT /library/files/{id} (rename), or
POST /library/files/move hit "administrative operations" 403, even
for keys with can_manage_library=True. Only slice worked, because it
doesn't go through require_ownership_permission.
The "ALL stays admin-only because it crosses the user boundary"
intent was internally inconsistent. API keys have no per-row
ownership identity (user=None), so the route's
`file.created_by_id != user.id` ownership check would AttributeError
on a key acting under OWN anyway — the only working path is
can_modify_all=True, which `all_perm` denial blocked outright.
Fix folds LIBRARY_UPDATE_ALL and LIBRARY_DELETE_ALL into
_APIKEY_SCOPE_BY_PERMISSION under can_manage_library, matching the
can_queue precedent (QUEUE_UPDATE_OWN and QUEUE_UPDATE_ALL both
map to can_queue for the same per-key-identity reason). Both removed
from _APIKEY_DENIED_PERMISSIONS. LIBRARY_PURGE stays denied — it
bypasses the soft-delete window and is genuinely destructive.
2026-06-28 12:47:59 +02:00
..
2026-06-06 10:41:28 +02:00
2026-06-28 12:47:59 +02:00
2026-06-04 11:30:26 +02:00
2026-04-26 09:40:02 +02:00
2026-02-21 11:35:18 +01:00
2026-02-21 10:01:26 +01:00
2026-06-03 10:14:57 +02:00
2026-04-27 16:14:31 +02:00
2026-05-30 13:49:09 +02:00
2026-06-20 12:07:20 +02:00
2026-05-14 08:58:33 +02:00
2026-03-20 14:18:24 +01:00
2026-02-21 10:39:18 +01:00
2026-05-22 10:02:41 +02:00
2026-06-06 13:40:56 +02:00
2026-04-27 16:32:10 +02:00
2026-04-17 08:38:22 +02:00
2026-03-07 10:13:40 +01:00
2026-06-25 09:00:57 +02:00
2026-04-18 08:14:53 +02:00
2026-05-24 12:51:24 +02:00
2026-02-16 15:46:32 +01:00
2026-05-08 09:01:51 +02:00
2026-05-15 15:43:37 +02:00
2026-05-08 11:52:42 +02:00
2026-05-24 10:16:30 +02:00
2026-04-11 11:14:54 +02:00
2026-06-05 13:53:26 +02:00
2026-04-26 14:24:28 +02:00
2026-05-29 10:55:41 +02:00
2026-05-24 08:49:21 +02:00
2026-06-09 07:38:59 +02:00
2026-05-28 08:40:43 +02:00
2026-06-05 13:53:26 +02:00
2026-06-22 07:43:16 +02:00
2026-06-06 13:30:13 +02:00
2026-06-19 11:29:07 +02:00
2026-04-27 16:32:10 +02:00
2026-05-11 12:27:41 +02:00
2026-05-03 08:12:36 +02:00
2026-04-24 16:02:55 +02:00
2026-02-07 19:01:04 +02:00
2026-05-08 14:06:40 +02:00
2026-06-20 12:07:20 +02:00
2026-05-16 14:35:47 +02:00
2026-04-11 11:33:49 +02:00
2026-06-02 14:51:08 +02:00
2026-04-22 11:14:42 +02:00
2026-06-02 14:51:08 +02:00
2026-05-22 10:22:14 +02:00
2026-06-13 07:49:31 +02:00
2026-06-22 14:23:30 +02:00
2026-06-17 11:33:23 +02:00
2026-06-17 11:33:23 +02:00
2026-02-06 12:19:17 +01:00
2026-04-26 10:01:17 +02:00
2026-03-19 08:40:24 +01:00
2026-06-05 09:29:53 +02:00
2026-04-24 16:48:59 +02:00
2026-06-02 10:02:17 +02:00
2026-06-02 10:02:17 +02:00
2026-06-02 12:42:16 +02:00
2026-06-20 08:28:44 +02:00
2026-05-21 08:45:59 +02:00
2026-04-13 09:54:26 +02:00
2026-05-15 08:50:37 +02:00
2026-05-15 08:50:37 +02:00
2026-05-15 08:50:37 +02:00
2026-05-15 08:50:37 +02:00
2026-05-08 11:52:42 +02:00
2026-03-03 13:34:03 +01:00
2026-06-25 14:54:27 +02:00
2026-03-31 12:13:58 +02:00
2026-03-07 09:17:26 +01:00
2026-04-22 17:48:53 +02:00
2026-02-06 12:19:17 +01:00
2026-04-29 11:17:43 +02:00
2026-05-17 09:30:02 +02:00
2026-02-15 13:14:15 +01:00
2026-03-18 11:13:27 +01:00
2026-05-20 08:12:17 +02:00
2026-06-09 09:16:36 +02:00
2026-06-20 12:07:20 +02:00
2026-06-10 10:59:27 +02:00
2026-06-20 12:07:20 +02:00
2026-05-21 08:30:17 +02:00
2026-06-20 12:55:24 +02:00
2026-05-04 10:34:36 +02:00
2026-06-08 08:18:13 +02:00
2026-06-11 09:23:03 +02:00
2026-06-25 11:07:29 +02:00
2026-05-05 16:00:22 +02:00
2026-06-22 14:13:44 +02:00
2026-05-19 10:53:36 +02:00
2026-04-07 09:20:58 +02:00
2026-05-25 09:04:47 +02:00
2026-06-02 12:12:54 +02:00
2026-05-24 09:18:38 +02:00
2026-06-25 12:47:26 +02:00
2026-06-20 12:07:20 +02:00
2026-03-20 11:34:23 +01:00
2026-06-26 12:31:48 +02:00
2026-04-13 09:12:12 +02:00
2026-04-28 17:19:17 +02:00
2026-06-09 10:43:07 +02:00
2026-02-22 16:43:16 +01:00
2026-05-20 11:25:45 +02:00
2026-05-24 09:18:38 +02:00
2026-06-08 07:54:24 +02:00
2026-04-24 13:24:00 +02:00
2026-06-17 12:04:57 +02:00
2026-05-14 15:28:41 +02:00
2026-06-12 10:14:06 +02:00
2026-06-12 10:14:06 +02:00
2026-02-10 09:38:06 +01:00
2026-04-20 17:32:34 +02:00
2026-06-26 16:48:22 +02:00
2026-04-29 09:13:33 +02:00
2026-04-25 13:24:49 +02:00
2026-05-12 16:02:24 +02:00
2026-05-08 11:52:42 +02:00
2026-05-08 14:28:41 +02:00
2026-03-26 16:35:29 +01:00
2026-04-09 08:16:54 +02:00
2026-05-08 11:52:42 +02:00
2026-05-18 08:51:27 +02:00
2026-06-17 11:33:23 +02:00
2026-06-25 10:46:57 +02:00
2026-05-12 08:48:30 +02:00
2026-05-20 11:00:54 +02:00
2026-06-09 09:16:36 +02:00
2026-05-08 11:52:42 +02:00
2026-05-22 09:05:25 +02:00
2026-06-14 10:58:02 +02:00
2026-02-15 15:47:41 +01:00
2026-06-18 11:46:07 +02:00
2026-06-20 08:28:44 +02:00
2026-05-24 12:30:12 +02:00
2026-05-12 09:20:53 +02:00
2026-04-26 14:24:28 +02:00
2026-05-15 08:50:37 +02:00
2026-06-20 12:26:31 +02:00
2026-03-17 12:24:36 +01:00
2026-06-22 11:15:39 +02:00
2026-06-05 17:19:16 +02:00
2026-05-30 13:34:10 +02:00
2026-05-30 13:34:10 +02:00
2026-03-18 09:04:31 +01:00
2026-05-30 13:34:10 +02:00
2026-06-02 14:33:20 +02:00
2026-06-14 10:52:41 +02:00
2026-06-09 08:22:38 +02:00
2026-06-03 10:04:37 +02:00
2026-06-11 13:35:20 +02:00