Prevent other users from editing public annotations

.pre-commit-config.yaml

@@ -22,7 +22,6 @@ repos:
       - id: debug-statements
       - id: destroyed-symlinks
       - id: detect-private-key
-      - id: double-quote-string-fixer
       - id: end-of-file-fixer
       - id: mixed-line-ending
         args: ['--fix=lf']

bats_ai/core/views/recording.py

@@ -412,8 +412,8 @@ def delete_recording(
     try:
         recording = Recording.objects.get(pk=id)
 
-        # Check if the user owns the recording or if the recording is public
-        if recording.owner == request.user or recording.public:
+        # Check if the user owns the recording
+        if recording.owner == request.user:
             # Delete the annotation
             recording.delete()
             return {"message": "Recording deleted successfully"}
@@ -881,7 +881,7 @@ def get_other_user_annotations(request: HttpRequest, id: int):
         recording = Recording.objects.get(pk=id)
 
         # Check if the user owns the recording or if the recording is public
-        if recording.owner == request.user or recording.public:
+        if recording.owner == request.user or request.user.is_superuser:
             # Query annotations associated with the recording that are owned by other users
             annotations_qs = Annotations.objects.filter(recording=recording).exclude(
                 owner=request.user
@@ -1007,6 +1007,8 @@ def patch_annotation(
             annotation_instance = Annotations.objects.get(
                 pk=id, recording=recording, owner=request.user
             )
+            if annotation_instance is None:
+                return {"error": "Annotation not found"}
 
             # Update annotation details
             if annotation.start_time is not None:

bats_ai/core/views/recording_annotation.py

@@ -147,6 +147,9 @@ def update_recording_annotation(
         annotation = RecordingAnnotation.objects.get(pk=id)
 
         # Check permission
+        if annotation.owner != request.user:
+            raise HttpError(403, "Permission denied.")
+
         if annotation.recording.owner != request.user and not annotation.recording.public:
             raise HttpError(403, "Permission denied.")
 
@@ -186,8 +189,8 @@ def delete_recording_annotation(request: HttpRequest, id: int):
 
         annotation = RecordingAnnotation.objects.get(pk=id)
 
-        # Check permission
-        if annotation.recording.owner != request.user:
+        # Check permission: only the annotation owner may delete their own
+        if annotation.owner != request.user:
             raise HttpError(403, "Permission denied.")
 
         annotation.delete()