Repository: fossasia/open-event-server

Issue:
Add missing permissions to speakers API
**I'm submitting a ...**  (check one with "x")
- [x] bug report
- [ ] feature request
- [ ] support request => Please do not submit support requests here, instead ask your query in out Gitter channel at https://gitter.im/fossasia/open-event-orga-server

**Current behavior:**
<!-- Describe how the bug manifests. -->

**Expected behavior:**
<!-- Describe what the behavior would be without the bug. -->

**Steps to reproduce:**
<!-- If you are able to illustrate the bug or feature request with an example, please provide steps to reproduce -->

**Related code:**

```
insert any relevant code here else remove this section
```

**Other information:**
<!-- List any other information that is relevant to your issue. Stack traces, related issues, suggestions on how to fix, Stack Overflow links, forum links, etc. -->

**System information:** 

<!-- Add information about the system your facing this bug on. If you think this is irrelevant or if it's a UI bug or a feature request, please remove this section -->

```
Your operating system
```

```
output of `python --version`
```



Discussion:

Resolving patch:
diff --git a/app/api/helpers/permission_manager.py b/app/api/helpers/permission_manager.py
--- a/app/api/helpers/permission_manager.py
+++ b/app/api/helpers/permission_manager.py
@@ -71,6 +71,25 @@ def is_user_itself(view, view_args, view_kwargs, *args, **kwargs):
     return view(*view_args, **view_kwargs)
 
 
+@jwt_required
+def is_coorganizer_or_user_itself(view, view_args, view_kwargs, *args, **kwargs):
+    """
+    Allows admin and super admin access to any resource irrespective of id.
+    Otherwise the user can only access his/her resource.
+    """
+    user = current_identity
+    if user.is_admin or user.is_super_admin or user.id == kwargs['user_id']:
+        return view(*view_args, **view_kwargs)
+
+    if user.is_staff:
+        return view(*view_args, **view_kwargs)
+
+    if user.is_organizer(kwargs['event_id']) or user.is_coorganizer(kwargs['event_id']):
+        return view(*view_args, **view_kwargs)
+
+    return ForbiddenError({'source': ''}, 'Co-organizer access is required.').respond()
+
+
 @jwt_required
 def is_registrar(view, view_args, view_kwargs, *args, **kwargs):
     """
@@ -135,7 +154,6 @@ def accessible_role_based_events(view, view_args, view_kwargs, *args, **kwargs):
 
 
 permissions = {
-
     'is_admin': is_admin,
     'is_organizer': is_organizer,
     'is_coorganizer': is_coorganizer,
@@ -143,7 +161,8 @@ def accessible_role_based_events(view, view_args, view_kwargs, *args, **kwargs):
     'is_registrar': is_registrar,
     'is_moderator': is_moderator,
     'user_event': user_event,
-    'accessible_role_based_events': accessible_role_based_events
+    'accessible_role_based_events': accessible_role_based_events,
+    'is_coorganizer_or_user_itself': is_coorganizer_or_user_itself
 }
 
 
diff --git a/app/api/speakers.py b/app/api/speakers.py
--- a/app/api/speakers.py
+++ b/app/api/speakers.py
@@ -10,6 +10,7 @@
 from app.models.user import User
 from app.models.event import Event
 from app.api.helpers.db import safe_query
+from app.api.bootstrap import api
 
 
 class SpeakerSchema(Schema):
@@ -124,7 +125,7 @@ def before_create_object(self, data, view_kwargs):
         data['user_id'] = current_identity.id
 
     view_kwargs = True
-    decorators = (jwt_required,)
+    decorators = (api.has_permission('accessible_role_based_events'),)
     schema = SpeakerSchema
     data_layer = {'session': db.session,
                   'model': Speaker,
@@ -139,7 +140,8 @@ class SpeakerDetail(ResourceDetail):
     """
     Speakers Detail by id
     """
-    decorators = (jwt_required,)
+    decorators = (api.has_permission('is_coorganizer_or_user_itself', methods="PATCH,DELETE", fetch="event_id",
+                                     fetch_as="event_id", model=Speaker, check=lambda a: a.get('id') is not None),)
     schema = SpeakerSchema
     data_layer = {'session': db.session,
                   'model': Speaker}


Test patch: