fix: Limit project query to member of project

terraso_backend/apps/project_management/graphql/projects.py

@@ -143,6 +143,12 @@ def resolve_seen(self, info):
             return True
         return self.seen_by.filter(id=user.id).exists()
 
+    @classmethod
+    def get_queryset(cls, queryset, info):
+        # limit queries to membership lists of projects to which the user belongs
+        user_pk = getattr(info.context.user, "pk", None)
+        return queryset.filter(membership_list__memberships__user_id=user_pk)
+
 
 class ProjectPrivacy(graphene.Enum):
     PRIVATE = Project.PRIVATE

terraso_backend/tests/graphql/test_projects_query.py

@@ -19,30 +19,45 @@
 
 pytestmark = pytest.mark.django_db
 
-
-def test_query_by_member(client, project, project_user):
-    project2 = Project(name="2")
-    project2.save()
-    query = """
+PROJECT_QUERY = """
     {
-      projects(member: "%s") {
+      projects {
         edges {
           node {
             id
             name
             membershipList {
               id
+              memberships {
+                edges {
+                  node {
+                    id
+                  }
+                }
+              }
             }
           }
         }
+        totalCount
       }
     }
-    """ % (
-        project_user.id,
-    )
+    """
+
+
+def test_query_by_member(client, project, project_user):
+    project2 = Project(name="2")
+    project2.save()
     client.force_login(project_user)
-    response = graphql_query(query, client=client)
+    response = graphql_query(PROJECT_QUERY, client=client)
     assert "errors" not in response.json()
     edges = response.json()["data"]["projects"]["edges"]
     assert len(edges) == 1
     assert edges[0]["node"]["name"] == str(project.name)
+
+
+def test_query_by_non_member(client, project):
+    response = graphql_query(PROJECT_QUERY, client=client)
+    payload = response.json()
+    assert "errors" not in payload
+    assert len(payload["data"]["projects"]["edges"]) == 0
+    assert payload["data"]["projects"]["totalCount"] == 0

terraso_backend/tests/graphql/test_sites_query.py

@@ -23,13 +23,13 @@
 pytestmark = pytest.mark.django_db
 
 
-def test_query_site_fields(client, project, user):
+def test_query_site_fields(client, project, project_user):
     sites = [
         Site(
             name="site 1",
             latitude=1.0,
             longitude=-1.0,
-            owner=user,
+            owner=project_user,
             privacy="PRIVATE",
             archived=False,
         ),
@@ -59,7 +59,7 @@ def test_query_site_fields(client, project, user):
       }
     }
     """
-    client.force_login(user)
+    client.force_login(project_user)
 
     for site, response in [(site, graphql_query(query % site.id, client=client)) for site in sites]:
         assert "errors" not in response.json()