Merge pull request #15 from LCOGT/fix/user_permissions

Update datasession and dataoperation get permissions to only those th…
LCOGT · May 20, 2024 · 9134c30 · 9134c30
2 parents a874463 + bcb344d
commit 9134c30
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/datalab/datalab_session/viewsets.py b/datalab/datalab_session/viewsets.py
@@ -13,7 +13,7 @@ class DataOperationViewSet(viewsets.ModelViewSet):
     serializer_class = DataOperationSerializer
 
     def get_queryset(self):
-        return DataOperation.objects.filter(session=self.kwargs['session_pk'])
+        return DataOperation.objects.filter(session=self.kwargs['session_pk'], session__user=self.request.user)
 
     def perform_create(self, serializer):
         operation = available_operations().get(serializer.validated_data['name'])(serializer.validated_data['input_data'])
@@ -30,7 +30,7 @@ class DataSessionViewSet(viewsets.ModelViewSet):
     ordering = ('created',)
 
     def get_queryset(self):
-        return DataSession.objects.all()
+        return DataSession.objects.filter(user=self.request.user).prefetch_related('operations')
 
     def perform_create(self, serializer):
         serializer.save(user=self.request.user)