def _add_tenant_filter(self, query, model_class, all_tenants):
"""Filter by the tenant ID associated with `model_class` (either
directly via a relationship with the tenants table, or via an
ancestor who has such a relationship)
"""
# Users/Groups etc. don't have tenants
if not model_class.is_resource:
return query
# not used from a request handler - no relevant user
if not has_request_context():
return query
current_tenant = self.current_tenant
# If a user passed the `all_tenants` flag
if all_tenants:
# If a user that is allowed to get all the tenants in the system
# no need to filter
if all_tenants_authorization():
return query
# Filter by all the tenants the user is allowed to list in
tenant_ids = [
tenant.id for tenant in current_user.all_tenants
if utils.tenant_specific_authorization(tenant,
model_class.__name__)
]
else:
# Specific tenant only
tenant_ids = [current_tenant.id] if current_tenant else []
# Match any of the applicable tenant ids or if it's a global resource
tenant_filter = sql_or(
model_class.visibility == VisibilityState.GLOBAL,
model_class._tenant_id.in_(tenant_ids)
)
return query.filter(tenant_filter)
def _add_tenant_filter(self, query, model_class, all_tenants):
"""Filter by the tenant ID associated with `model_class` (either
directly via a relationship with the tenants table, or via an
ancestor who has such a relationship)
"""
# Users/Groups etc. don't have tenants
if not model_class.is_resource:
return query
# not used from a request handler - no relevant user
if not has_request_context():
return query
current_tenant = self.current_tenant
# If a user passed the `all_tenants` flag
if all_tenants:
# If a user that is allowed to get all the tenants in the system
# no need to filter
if all_tenants_authorization():
return query
# Filter by all the tenants the user is allowed to list in
tenant_ids = [
tenant.id for tenant in current_user.all_tenants
if utils.tenant_specific_authorization(tenant,
model_class.__name__)
]
else:
# Specific tenant only
tenant_ids = [current_tenant.id] if current_tenant else []
# Match any of the applicable tenant ids or if it's a global resource
tenant_filter = sql_or(
model_class.visibility == VisibilityState.GLOBAL,
model_class._tenant_id.in_(tenant_ids)
)
return query.filter(tenant_filter)