From c557ed4ec30c2edc99c9fa4215a5948a2a67a764 Mon Sep 17 00:00:00 2001
From: bklvsky <alexandrakachanova@gmail.com>
Date: Mon, 21 Oct 2024 19:27:40 +0000
Subject: [PATCH] Update `products/{id}/add_platforms` for
 AlmaLinux/build-system#359

- Add access control
- black formatting
---
 alws/crud/products.py    | 18 ++++++++++++------
 alws/routers/products.py |  5 ++++-
 2 files changed, 16 insertions(+), 7 deletions(-)

diff --git a/alws/crud/products.py b/alws/crud/products.py
index 7e168081..abc7e588 100644
--- a/alws/crud/products.py
+++ b/alws/crud/products.py
@@ -38,7 +38,7 @@ async def add_repos_to_product(
     pulp_client: PulpClient,
     product: models.Product,
     owner: models.User,
-    platforms: List[models.Platform]
+    platforms: List[models.Platform],
 ):
     repos_to_insert = []
     repo_tasks = []
@@ -86,7 +86,7 @@ async def add_repos_to_product(
             production=True,
             export_path=export_path,
         )
-        
+
         repos_to_insert.append(repo)
     return repos_to_insert
 
@@ -390,6 +390,7 @@ async def add_platform_to_product(
     session: AsyncSession,
     product_id: int,
     platforms: List[Platform],
+    user_id: int,
 ):
     pulp_client = PulpClient(
         settings.pulp_host,
@@ -397,6 +398,13 @@ async def add_platform_to_product(
         settings.pulp_password,
     )
     db_product = await get_products(session, product_id=product_id)
+    db_user = await get_user(session, user_id=user_id)
+    if not db_user:
+        raise DataNotFoundError(f"User={user_id} doesn't exist")
+    if not can_perform(db_product, db_user, actions.UpdateProduct.name):
+        raise PermissionDenied(
+            f'User has no permissions to modify the product "{db_product.name}"'
+        )
     db_platforms = (
         (
             await session.execute(
@@ -415,7 +423,7 @@ async def add_platform_to_product(
         pulp_client=pulp_client,
         owner=db_product.owner,
         product=db_product,
-        platforms=db_platforms
+        platforms=db_platforms,
     )
     db_product.repositories.extend(repos)
     session.add_all(repos)
@@ -438,9 +446,7 @@ async def get_repo_product(
                 await session.execute(
                     select(Build)
                     .filter(
-                        Build.repos.any(
-                            Repository.name.ilike(f'%{repository}')
-                        )
+                        Build.repos.any(Repository.name.ilike(f'%{repository}'))
                     )
                     .options(
                         joinedload(Build.team)
diff --git a/alws/routers/products.py b/alws/routers/products.py
index f1e6b8e7..e7e271b5 100644
--- a/alws/routers/products.py
+++ b/alws/routers/products.py
@@ -185,9 +185,12 @@ async def add_platforms(
     product_id: int,
     platforms: List[product_schema.Platform],
     db: AsyncSession = Depends(AsyncSessionDependency(key=get_async_db_key())),
+    user: User = Depends(get_current_user),
 ):
     try:
-        await products.add_platform_to_product(db, product_id, platforms)
+        await products.add_platform_to_product(
+            db, product_id, platforms, user.id
+        )
     except Exception as exc:
         raise HTTPException(
             detail=str(exc),