From 640c97213dc07a507bd23b64782d720f55336946 Mon Sep 17 00:00:00 2001 From: Marc 'risson' Schmitt Date: Thu, 9 Jan 2025 14:08:45 +0100 Subject: [PATCH 1/2] rbac: permissions endpoint: allow authenticated users Signed-off-by: Marc 'risson' Schmitt --- authentik/rbac/api/rbac.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/authentik/rbac/api/rbac.py b/authentik/rbac/api/rbac.py index 397d8696d6df..1f79123bbc2c 100644 --- a/authentik/rbac/api/rbac.py +++ b/authentik/rbac/api/rbac.py @@ -13,6 +13,7 @@ ReadOnlyField, SerializerMethodField, ) +from rest_framework.permissions import IsAuthenticated from rest_framework.viewsets import ReadOnlyModelViewSet from authentik.core.api.utils import ModelSerializer, PassiveSerializer @@ -93,6 +94,7 @@ class RBACPermissionViewSet(ReadOnlyModelViewSet): serializer_class = PermissionSerializer ordering = ["name"] filterset_class = PermissionFilter + permission_classes = [IsAuthenticated] search_fields = [ "codename", "content_type__model", From 96dc388fa4094ae353f5bd0cae8179e86c9f972c Mon Sep 17 00:00:00 2001 From: Marc 'risson' Schmitt Date: Thu, 9 Jan 2025 14:12:37 +0100 Subject: [PATCH 2/2] fix filters Signed-off-by: Marc 'risson' Schmitt --- authentik/rbac/api/rbac.py | 3 +++ 1 file changed, 3 insertions(+) diff --git a/authentik/rbac/api/rbac.py b/authentik/rbac/api/rbac.py index 1f79123bbc2c..9e6a2517f326 100644 --- a/authentik/rbac/api/rbac.py +++ b/authentik/rbac/api/rbac.py @@ -5,6 +5,7 @@ from django.db.models import QuerySet from django_filters.filters import ModelChoiceFilter from django_filters.filterset import FilterSet +from django_filters.rest_framework import DjangoFilterBackend from rest_framework.exceptions import ValidationError from rest_framework.fields import ( CharField, @@ -13,6 +14,7 @@ ReadOnlyField, SerializerMethodField, ) +from rest_framework.filters import OrderingFilter, SearchFilter from rest_framework.permissions import IsAuthenticated from rest_framework.viewsets import ReadOnlyModelViewSet @@ -93,6 +95,7 @@ class RBACPermissionViewSet(ReadOnlyModelViewSet): queryset = Permission.objects.none() serializer_class = PermissionSerializer ordering = ["name"] + filter_backends = [DjangoFilterBackend, OrderingFilter, SearchFilter] filterset_class = PermissionFilter permission_classes = [IsAuthenticated] search_fields = [