🛂(abilities) fix anonymous and unrelated users accessing resources

The function computing abilities return "True" for method get, even if role of request user was None.
2024-03-06 16:06:59 +01:00
parent 18971a10e0
commit b2956e42d3
2 changed files with 3 additions and 3 deletions
--- a/src/backend/core/models.py
+++ b/src/backend/core/models.py
@@ -355,7 +355,7 @@ class Team(BaseModel):
            is_owner_or_admin = role in [RoleChoices.OWNER, RoleChoices.ADMIN]

        return {
-            "get": True,
+            "get": bool(role),
            "patch": is_owner_or_admin,
            "put": is_owner_or_admin,
            "delete": role == RoleChoices.OWNER,