minor: 项目 API 依赖项目查看权限 --story=119850966

TencentBlueKing · Oct 8, 2024 · 095ea83 · 095ea83
1 parent c5e041c
commit 095ea83
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 2 deletions.
diff --git a/itsm/postman/permissions.py b/itsm/postman/permissions.py
@@ -88,5 +88,8 @@ def has_object_permission(self, request, view, obj, **kwargs):
             # 项目管理
             project_key = obj.remote_system.project_key
             project = Project.objects.get(pk=project_key)
-            return self.iam_auth(request, ["system_settings_manage"], project)
+            apply_actions = ["system_settings_manage"]
+            if view.action == "retrieve":
+                apply_actions = ["project_view"]
+                return self.iam_auth(request, apply_actions, project)
         return True
diff --git a/itsm/postman/views.py b/itsm/postman/views.py
@@ -191,7 +191,6 @@ class RemoteApiViewSet(DynamicListModelMixin, ModelViewSet):
     permission_classes = (RemoteApiPermit,)
     permission_resource_is_project = True
     permission_create_action = ["create", "imports"]
-    permission_free_actions = ["retrieve"]
 
     filter_fields = {
         "is_activated": ["exact"],