[change] Improved logic for hiding sensitive fields

Author: pandafy

openwisp_users/api/mixins.py

@@ -154,6 +154,52 @@ class FilterByParentOwned(SharedObjectsLookup, FilterByParent):
     _user_attr = "organizations_owned"
 
 
+class HideSensitiveFieldsMixin:
+    """
+    Mixin to hide sensitive fields in the serializer representation
+    based on the organization of the user.
+    """
+
+    def get_sensitive_fields(self):
+        """
+        Returns a list of sensitive fields that should be hidden.
+        """
+        ModelClass = self.Meta.model
+        return getattr(ModelClass, "sensitive_fields", [])
+
+    def _is_object_shared(self, instance):
+        """
+        Returns the organization of the instance if it exists.
+        """
+        view = self.context.get("view")
+        organization_field = getattr(view, "organization_field", "organization_id")
+        related_field = instance
+        for field in organization_field.split("__"):
+            if hasattr(related_field, field):
+                related_field = getattr(related_field, field)
+            else:
+                return False
+        return related_field is None
+
+    def hide_sensitive_fields(self, obj):
+        request = self.context.get("request")
+        if (
+            request
+            and not request.user.is_superuser
+            and "organization" in obj
+            and obj["organization"] is None
+        ):
+            for field in self.get_sensitive_fields():
+                if field in obj:
+                    del obj[field]
+        return obj
+
+    def to_representation(self, data):
+        rep = super().to_representation(data)
+        self.hide_sensitive_fields(rep)
+        return rep
+
+
 class FilterSerializerByOrganization(OrgLookup):
     """
     Filter the options in browsable API for serializers
@@ -190,58 +236,37 @@ def filter_fields(self):
             except AttributeError:
                 pass
 
-    def get_sensitive_fields(self):
-        """
-        Returns a list of sensitive fields that should be hidden
-        when the organization is None and the user is not a superuser.
-        """
-        ModelClass = self.Meta.model
-        return getattr(ModelClass, "sensitive_fields", [])
-
     def __init__(self, *args, **kwargs):
         super().__init__(*args, **kwargs)
         # only filter related fields if the serializer
         # is being initiated during an HTTP request
         if "request" in self.context:
             self.filter_fields()
 
-    def to_representation(self, data):
-        rep = super().to_representation(data)
-        # Handle single object serializers
-        self.hide_sensitive_fields(rep)
-        return rep
 
-    def hide_sensitive_fields(self, obj):
-        request = self.context.get("request")
-        if (
-            request
-            and not request.user.is_superuser
-            and "organization" in obj
-            and obj["organization"] is None
-        ):
-            for field in self.get_sensitive_fields():
-                if field in obj:
-                    del obj[field]
-        return obj
-
-
-class FilterSerializerByOrgMembership(FilterSerializerByOrganization):
+class FilterSerializerByOrgMembership(
+    HideSensitiveFieldsMixin, FilterSerializerByOrganization
+):
     """
     Filter serializer by organizations the user is member of
     """
 
     _user_attr = "organizations_dict"
 
 
-class FilterSerializerByOrgManaged(FilterSerializerByOrganization):
+class FilterSerializerByOrgManaged(
+    HideSensitiveFieldsMixin, FilterSerializerByOrganization
+):
     """
     Filter serializer by organizations managed by user
     """
 
     _user_attr = "organizations_managed"
 
 
-class FilterSerializerByOrgOwned(FilterSerializerByOrganization):
+class FilterSerializerByOrgOwned(
+    HideSensitiveFieldsMixin, FilterSerializerByOrganization
+):
     """
     Filter serializer by organizations owned by user
     """

openwisp_users/multitenancy.py

@@ -80,23 +80,25 @@ def get_queryset(self, request):
             # if there is no organization field, return the queryset as is
             return qs
         return qs.filter(
-            Q(**{f"{self.org_field}__in": user.organizations_managed}) | Q(**{self.org_field: None})
+            Q(**{f"{self.org_field}__in": user.organizations_managed})
+            | Q(**{self.org_field: None})
         )
 
     def get_search_results(self, request, queryset, search_term):
         """
         Override to ensure that the search results are filtered by the
         organization of the current user.
         """
-        if request.GET.get('field_name') and not request.user.is_superuser and not self.multitenant_shared_relations:
+        if (
+            request.GET.get("field_name")
+            and not request.user.is_superuser
+            and not self.multitenant_shared_relations
+        ):
             queryset = queryset.filter(
-                **{
-                    f"{self.org_field}__in": request.user.organizations_managed
-                }
+                **{f"{self.org_field}__in": request.user.organizations_managed}
             )
         return super().get_search_results(request, queryset, search_term)
 
-
     def _has_org_permission(self, request, obj, perm_func):
         """
         Helper method to check object-level permissions for users

openwisp_users/tests/test_api/__init__.py

@@ -47,7 +47,10 @@ def _test_access_shared_object(
                     **auth,
                 )
                 self.assertEqual(response.status_code, expected_status_codes["create"])
-                if expected_status_codes["create"] == 400 and 'organization' in create_payload:
+                if (
+                    expected_status_codes["create"] == 400
+                    and "organization" in create_payload
+                ):
                     self.assertEqual(
                         str(response.data["organization"][0]),
                         "This field may not be null.",