Disable further checking permissions if at least one is False (#7803)

changelog.d/20240425_161412_sekachev.bs.md

@@ -0,0 +1,4 @@
+### Fixed
+
+- Extra requests in PolicyEnforcer when at least one policy is rejected, others are not checked
+  (<https://github.com/cvat-ai/cvat/pull/7803>)

cvat/apps/iam/permissions.py

@@ -211,18 +211,14 @@ def check_permission(self, request, view, obj) -> bool:
         if self.is_metadata_request(request, view) or obj and is_public_obj(obj):
             return True
 
-        permissions: List[OpenPolicyAgentPermission] = []
         iam_context = get_iam_context(request, obj)
+        for perm_class in OpenPolicyAgentPermission.__subclasses__():
+            for perm in perm_class.create(request, view, obj, iam_context):
+                result = perm.check_access()
+                if not result.allow:
+                    return False
 
-        for perm in OpenPolicyAgentPermission.__subclasses__():
-            permissions.extend(perm.create(request, view, obj, iam_context))
-
-        allow = True
-        for perm in permissions:
-            result = perm.check_access()
-            allow &= result.allow
-
-        return allow
+        return True
 
     def has_permission(self, request, view):
         if not view.detail: