Fixes: #14634 - Bypass Write permissions for render endpoint

[DanSheps]

Fixes: #14634 - Bypass Write permissions for render endpoint

• Bypass permission for render endpoint by swapping the permissions map and overriding the restrict() action.

[jeremystretch]

@DanSheps are you still working on this?

[DanSheps]

Yes, sorry, I will get back on it. Trying to find an elegant way to do this.

[DanSheps]

We could alternatively modify:

class BaseViewSet(GenericViewSet):
    """
    Base class for all API ViewSets. This is responsible for the enforcement of object-based permissions.
    """
    def initial(self, request, *args, **kwargs):
        super().initial(request, *args, **kwargs)

        # Restrict the view's QuerySet to allow only the permitted objects
        if request.user.is_authenticated:
            if action := HTTP_ACTIONS[request.method]:
                self.queryset = self.queryset.restrict(request.user, action)

to account for permissions using:

self.get_permissions() and using the resulting perms_map to determine what permission should be applied.

This is a down the road thing IMO though.

[jeremystretch]

We'll definitely need to identify a more maintainable solution. This will probably entail digging into DRF permissions logic a bit.

[DanSheps]

As mentioned above, I think we can figure out something by modifying the BaseViewSet and then adjusting the queryset based on that.

I will take a second crack at this on the weekend.

[github-actions]

This PR has been automatically marked as stale because it has not had recent activity. It will be closed automatically if no further action is taken.

[DanSheps]

Need to get back to this.

[jeremystretch]

Great work @DanSheps!

[jeremystretch]

@DanSheps can you address the CI failures please?

[DanSheps]

@DanSheps can you address the CI failures please?

I had to make some changes, mainly going back to overriding the permissions map as I couldn't cleanly reslolve certain issues without overriding a number of methods to return view-only permissions.

Reason being is DJango checks to make sure the method has permissions before proceeding to check the more specific permissions and before hitting inital() within the ViewSet.

I found myself overriding get_required_permissions as well as a few others just to get where I needed to be and it wouldn't be what I would deem "clean". (FWIW, I tried to alter the perms_map in __init__(), but it looks like unless it is a local variable to that specific class any changes to it within __init__() trickles down to the parent class as well)

[jeremystretch]

This approach isn't sufficient as it doesn't permit the use of a write-disabled API token. We need to override has_permission() and has_object_permission() on the permission class.

[jeremystretch]

Thanks for all your work on this @DanSheps; sorry it turned out to be more trouble than it's worth. I'm going to close this PR as #14634 has been superseded by #16681 per our discussion yesterday. Thanks again!

[DanSheps]

Thanks for all your work on this @DanSheps; sorry it turned out to be more trouble than it's worth. I'm going to close this PR as #14634 has been superseded by #16681 per our discussion yesterday. Thanks again!

It was a fun learning exercise with the Django permissions framework so it isn't all bad.