daisylb / bridgekeeper

Django permissions, but with QuerySets
https://bridgekeeper.leigh.party/
MIT License
42 stars 14 forks source link

Automatically create nested R object rules if required #23

Closed philipstarkey closed 3 years ago

philipstarkey commented 4 years ago

This Fixes #22

R rules that traverse many-to-one or many-to-many relationships are now broken up automatically within R.check() into multiple, chained R rules.

Tests to confirm both the original nested R syntax, and a the new unnested syntax, have been added.

philipstarkey commented 3 years ago

So I've realised that while my idea here was good, the execution had flaws. Basically I've realised that my patch turns R(m2mrelation__field1=1, m2mrelation__field2=2) into the equivalent of (ignore the invalid Python syntax - as it's actually implemented dynamically mid-iteration over the kwargs, there was never any invalid syntax) R(m2mrelation=R(field1=1), m2mrelation=R(field2=2)) when it should actually have been dynamically generating R(m2mrelation=R(field1=1, field2=2)) in order to ensure that the conditions were checked on the same related object (thus matching the behaviour of Rule.filter()).

In short - this patch leads to inconsistent behaviour between R.filter() and R.check() and should be thrown in the bin! So I'll close my PR.