Repository: OpenEnergyPlatform/oeplatform

Issue:
adding tags to tables (which are not in model_draft) triggers http 403 forbidden
When adding a tag (via the sidebar menu) to a table, e.g. [this one](https://openenergy-platform.org/dataedit/view/boundaries/bkg_gn250_b), an htttp 403 error is thrown. This was only reproducible for tables that are not in model_draft schema/topic. It seems that the permission check is too strict. We don't want to allow the user to upload data to a table in a specific schema (that is not model_draft), but we do want them to be able to edit the metadata and tags. 

Edit: Adding tags via the metaEdit (keywords) will also update the table tags.

@Ludee, do you agree? or do we need to check that we are all on the same page about where what permission should apply?


Discussion:
We do not have a proper definition of all permissions and rules yet. This is always done case-by-case until now. This must be discussed in a larger group. Let's try to find a good place to document this and start with the current rules as a base for discussion and implementation.
I use the workaround to add the tags using the keys of the metadata for now.
I will provide a list with the current permissions. 

Resolving patch:
diff --git a/api/actions.py b/api/actions.py
--- a/api/actions.py
+++ b/api/actions.py
@@ -38,6 +38,7 @@
 from dataedit.structures import Tag as OEDBTag
 from oeplatform.securitysettings import PLAYGROUNDS, UNVERSIONED_SCHEMAS
 
+
 pgsql_qualifier = re.compile(r"^[\w\d_\.]+$")
 
 
@@ -77,6 +78,10 @@ def get_table_name(schema, table, restrict_schemas=True):
     if restrict_schemas:
         if schema not in PLAYGROUNDS + UNVERSIONED_SCHEMAS:
             raise PermissionDenied
+    # TODO check if table in schema_whitelist but circular import
+    # from dataedit.views import schema_whitelist
+    # if schema not in schema_whitelist
+    #     raise PermissionDenied
     return schema, table
 
 
@@ -97,6 +102,34 @@ def assert_permission(user, table, permission, schema=None):
         raise PermissionDenied
 
 
+def assert_add_tag_permission(user, table, permission, schema):
+    """
+    Tags can be added to tables that are in any schema. However, 
+    it is necessary to check whether the user has write permission 
+    to the table, since not every user should be able to add tags 
+    to every table.
+
+    Args:
+        user (_type_): _description_
+        table (_type_): _description_
+        permission (_type_): _description_
+        schema (_type_): _description_
+
+    Raises:
+        PermissionDenied: _description_
+    
+    """
+    # if not request.user.is_anonymous:
+    #         level = request.user.get_table_permission_level(table)
+    #         can_add = level >= login_models.WRITE_PERM
+
+    if (
+        user.is_anonymous
+        or user.get_table_permission_level(DBTable.load(schema, table)) < permission
+    ):
+        raise PermissionDenied
+
+
 def _translate_fetched_cell(cell):
     if isinstance(cell, geoalchemy2.WKBElement):
         return _get_engine().execute(cell.ST_AsText()).scalar()
diff --git a/dataedit/views.py b/dataedit/views.py
--- a/dataedit/views.py
+++ b/dataedit/views.py
@@ -1476,11 +1476,11 @@ def update_table_tags(request):
     """
     # check if valid table / schema
     schema, table = actions.get_table_name(
-        schema=request.POST["schema"], table=request.POST["table"]
+        schema=request.POST["schema"], table=request.POST["table"], restrict_schemas=False
     )
 
     # check write permission
-    actions.assert_permission(
+    actions.assert_add_tag_permission(
         request.user, table, login_models.WRITE_PERM, schema=schema
     )
 


Test patch: