fix permission checks for command forms

2025-03-21 18:46:22 +07:00
parent 66a6de8b20
commit 732c86b6fb
1 changed files with 12 additions and 7 deletions
--- a/src/qbot/bot/handlers/editors/main_callbacks.py
+++ b/src/qbot/bot/handlers/editors/main_callbacks.py
@@ -260,14 +260,19 @@ async def process_field_edit_callback(message: Message | CallbackQuery, **kwargs

            # What if user has several roles and each role has its own ownership field? Should we allow creation even
            # if user has no CREATE_ALL permission
-            user_permissions = get_user_permissions(user, entity_descriptor)

-            for role in user.roles:
-                if (
-                    role in entity_descriptor.ownership_fields
-                    and EntityPermission.CREATE_ALL not in user_permissions
-                ):
-                    entity_data[entity_descriptor.ownership_fields[role]] = user.id
+            if callback_data.context in [
+                CommandContext.ENTITY_CREATE,
+                CommandContext.ENTITY_EDIT,
+            ]:
+                user_permissions = get_user_permissions(user, entity_descriptor)
+
+                for role in user.roles:
+                    if (
+                        role in entity_descriptor.ownership_fields
+                        and EntityPermission.CREATE_ALL not in user_permissions
+                    ):
+                        entity_data[entity_descriptor.ownership_fields[role]] = user.id

            deser_entity_data = {
                key: await deserialize(