has_add_permission() cannot prevent object creation

closeio / flask-mongorest

Restful API framework wrapped around MongoEngine

Other

522 stars 87 forks source link

has_add_permission() cannot prevent object creation #129

Open lfagundes opened 4 years ago

lfagundes commented 4 years ago

On views.py:162, object is created without save=True, so it's saved in database before has_add_permission is called, 5 lines below.

I tried to create a PR with a fix, by first calling create_object(save=False), then self._resource.save_object(obj). But on tests/init.py:304 there's an explicit expectation that the unauthorized object have been saved.

Is this really the expected behavior?

wojcikstefan commented 4 years ago

Hi @lfagundes, good catch! It's definitely not expected that you can persist an object w/o having an "add" permission. If tests need altering to reflect this, then feel very welcome to change them.