Skip to content

Commit c21b56b

Browse files
authored
Ensure that an individual contact can't be hijacked (Netflix#926)
1 parent b6a2194 commit c21b56b

1 file changed

Lines changed: 12 additions & 2 deletions

File tree

‎src/dispatch/individual/views.py‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,8 @@
33
from fastapi import APIRouter, Depends, HTTPException, Query
44
from sqlalchemy.orm import Session
55

6+
from dispatch.auth.permissions import PermissionsDependency, AdminPermission
7+
68
from dispatch.database import get_db, search_filter_sort_paginate
79

810
from .models import (
@@ -72,7 +74,12 @@ def get_individual(*, db_session: Session = Depends(get_db), individual_contact_
7274
return individual
7375

7476

75-
@router.put("/{individual_contact_id}", response_model=IndividualContactRead)
77+
@router.put(
78+
"/{individual_contact_id}",
79+
response_model=IndividualContactRead,
80+
summary="Update an individuals contact information.",
81+
dependencies=[Depends(PermissionsDependency([AdminPermission]))],
82+
)
7683
def update_individual(
7784
*,
7885
db_session: Session = Depends(get_db),
@@ -93,7 +100,10 @@ def update_individual(
93100
return individual
94101

95102

96-
@router.delete("/{individual_contact_id}")
103+
@router.delete(
104+
"/{individual_contact_id}",
105+
summary="Delete an individual contact.",
106+
dependencies=[Depends(PermissionsDependency([AdminPermission]))])
97107
def delete_individual(*, db_session: Session = Depends(get_db), individual_contact_id: int):
98108
"""
99109
Delete a individual contact.

0 commit comments

Comments
 (0)