diff --git a/cadasta/core/serializers.py b/cadasta/core/serializers.py index 27cf70dae..e37c57303 100644 --- a/cadasta/core/serializers.py +++ b/cadasta/core/serializers.py @@ -4,10 +4,11 @@ class DetailSerializer: def __init__(self, *args, **kwargs): detail = kwargs.pop('detail', False) + hide_detail = kwargs.pop('hide_detail', False) super(DetailSerializer, self).__init__(*args, **kwargs) is_list = type(self.instance) in [list, QuerySet] - if is_list and not detail: + if hide_detail or (is_list and not detail): for field_name in self.Meta.detail_only_fields: self.fields.pop(field_name) diff --git a/cadasta/organization/serializers.py b/cadasta/organization/serializers.py index 04d433989..2c21e910f 100644 --- a/cadasta/organization/serializers.py +++ b/cadasta/organization/serializers.py @@ -48,7 +48,7 @@ def create(self, *args, **kwargs): class ProjectSerializer(DetailSerializer, serializers.ModelSerializer): users = UserSerializer(many=True, read_only=True) - organization = OrganizationSerializer(read_only=True) + organization = OrganizationSerializer(hide_detail=True, read_only=True) country = CountryField(required=False) def validate_name(self, value): diff --git a/cadasta/organization/tests/test_views_api_projects.py b/cadasta/organization/tests/test_views_api_projects.py index 259a9f0e4..3b287d407 100644 --- a/cadasta/organization/tests/test_views_api_projects.py +++ b/cadasta/organization/tests/test_views_api_projects.py @@ -311,6 +311,18 @@ def test_full_list_with_superuser(self): assert len(response.content) == 4 def test_full_list_with_unauthorized_user(self): + """ + It should return projects without member information. + """ + ProjectFactory.create_batch(2, organization=self.organization) + ProjectFactory.create_batch(2) + response = self.request() + assert response.status_code == 200 + assert len(response.content) == 4 + assert all(['users' not in proj['organization'] + for proj in response.content]) + + def test_empty_list_with_unauthorized_user(self): """ It should 403 "You do not have permission to perform this action." """ diff --git a/cadasta/organization/views/api.py b/cadasta/organization/views/api.py index 54204ea5c..dcfeacfa5 100644 --- a/cadasta/organization/views/api.py +++ b/cadasta/organization/views/api.py @@ -145,7 +145,7 @@ class ProjectList(APIPermissionRequiredMixin, mixins.ProjectQuerySetMixin, filter_fields = ('archived',) search_fields = ('name', 'organization__name', 'country', 'description',) ordering_fields = ('name', 'organization', 'country', 'description',) - permission_required = {'project.list'} + permission_required = 'project.list' class ProjectDetail(APIPermissionRequiredMixin,