<commit_before>package MediaWords::ActionRole::AbstractAuthenticatedActionRole;

#
# Action role that logs requests
#

use strict;
use warnings;

use Modern::Perl "2015";
use MediaWords::CommonLibs;

use Moose::Role;
use namespace::autoclean;

use Data::Dumper;
use HTTP::Status qw(:constants);

use MediaWords::DBI::Auth;

# test whether the authenticated user has $permission_type access to the topic in the path of the currently requested
# url.   Queries the topics_with_user_permission view to determine the permissions for the current user.
sub _test_for_topic_permission
{
    my ( $self, $c, $permission_type ) = @_;

    my $path = $c->req->path;

    die( "unable to parse request path '$path' for topics_id" ) if ( $path !~ m~/topics/(\d+)/~ );

    my $topics_id = $1;

    my ( $user_email, $user_roles ) = $self->_user_email_and_roles( $c );
    unless ( $user_email and $user_roles )
    {
        $c->response->status( HTTP_FORBIDDEN );
        die 'Invalid API key or authentication cookie. Access denied.';
    }

    my $topic = $c->dbis->query( <<SQL, $topics_id, $user_email )->hash;
select t.*
    from topics_with_user_permission t
        join auth_users u using ( auth_users_id )
    where
        t.topics_id = \$1 and
        u.email = \$2
SQL

    my $user_permission = $topic->{ user_permission };

    my $allowed_permissions_lookup = {
        read  => [ qw/read write admin/ ],
        write => [ qw/write admin/ ],
        admin => [ qw/admin/ ]
    };

    my $allowed_permissions = $allowed_permissions_lookup->{ $permission_type };
    die( "Unknown permission type '$permission_type'" ) unless ( $allowed_permissions );

    if ( !( grep { $_ eq $user_permission } @{ $allowed_permissions } ) )
    {
        $c->response->status( HTTP_FORBIDDEN );
        die( "User lacks $permission_type permission for the requested topic" );
    }
}

sub _authenticate_topic<commit_msg>fix permission tests for is_public topics and admin users<commit_after>package MediaWords::ActionRole::AbstractAuthenticatedActionRole;

#
# Action role that logs requests
#

use strict;
use warnings;

use Modern::Perl "2015";
use MediaWords::CommonLibs;

use Moose::Role;
use namespace::autoclean;

use Data::Dumper;
use HTTP::Status qw(:constants);

use MediaWords::DBI::Auth;

# test whether the authenticated user has $permission_type access to the topic in the path of the currently requested
# url.   Queries the topics_with_user_permission view to determine the permissions for the current user.
sub _test_for_topic_permission
{
    my ( $self, $c, $permission_type ) = @_;

    my $path = $c->req->path;

    die( "unable to parse request path '$path' for topics_id" ) if ( $path !~ m~/topics/(\d+)/~ );

    my $topics_id = $1;

    my ( $user_email, $user_roles ) = $self->_user_email_and_roles( $c );
    unless ( $user_email and $user_roles )
    {
        $c->response->status( HTTP_FORBIDDEN );
        die 'Invalid API key or authentication cookie. Access denied.';
    }

    return if ( grep { $_ eq $MediaWords::DBI::Auth::Roles::ADMIN } @{ $user_roles } );
    return
      if ( ( $permission_type eq 'read' ) && grep { $_ eq $MediaWords::DBI::Auth::Roles::ADMIN_READONLY } @{ $user_roles } );

    my $topic = $c->dbis->query( <<SQL, $topics_id, $user_email )->hash;
select t.*
    from topics_with_user_permission t
        join auth_users u using ( auth_users_id )
    where
        t.topics_id = \$1 and
        u.email = \$2
SQL

    my $user_permission = $topic->{ user_permission };

    return if ( $topic->{ is_public } && ( $topic->{ user_permission } eq 'read' ) );

    my $allowed_permissions_lookup = {
        read  => [ qw/read write admin/ ],
        write => [ qw/write admin/ ],
        admin => [ qw/admin/ ]
    };

    my $allowed_permissions = $allowed_permissions_lookup->{ $permission_type };
    die( "Unknown permission type '$permission_type'" ) unless ( $allowed_permissions );

    if ( !( grep { $_ eq $user_permission } @{ $allowed_permissions } ) )
    {
        $c->response->status( HTTP_FORBIDDEN );
        die( "User lacks $permission_type permission for the requested topic" );
    }
}

sub _authenticate_topic
{'fraction_non_alphanumeric': 0.128260349365877, 'fraction_numerical': 0.0033500837520938024, 'mean_word_length': 3.3723849372384938, 'pattern_counts': {'":': 0, '<': 7, '<?xml version=': 0, '>': 35, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '255361', 'n_tokens_mistral': 1386, 'n_tokens_neox': 1337, 'n_words': 370}