[Eng-496] fix: authz check for every nested routing api

care/emr/api/viewsets/device.py

@@ -350,18 +350,42 @@ class DeviceLocationHistoryViewSet(EMRModelReadOnlyViewSet):
     def get_device(self):
         return get_object_or_404(Device, external_id=self.kwargs["device_external_id"])
 
-    def get_queryset(self):
+    def authorize_retrieve(self, model_instance):
         device = self.get_device()
         if not AuthorizationController.call(
-            "can_read_device", self.request.user, device
+            "can_read_device",
+            self.request.user,
+            device,
         ):
             raise PermissionDenied("You do not have permission to access the device")
+        if device.id != model_instance.device_id:
+            raise ValidationError(
+                "device does not match with the device location history"
+            )
 
-        return (
-            DeviceLocationHistory.objects.filter(device=device)
-            .select_related("location")
-            .order_by("-end")
+    def get_queryset(self):
+        device = self.get_device()
+        queryset = (
+            super()
+            .get_queryset()
+            .select_related("created_by", "updated_by")
+            .order_by("-modified_date")
         )
+        if self.action == "list":
+            if not AuthorizationController.call(
+                "can_read_device",
+                self.request.user,
+                device,
+            ):
+                raise PermissionDenied(
+                    "You do not have permission to access the device"
+                )
+            return (
+                DeviceLocationHistory.objects.filter(device=device)
+                .select_related("location")
+                .order_by("-end")
+            )
+        return queryset
 
 
 class DeviceEncounterHistoryViewSet(EMRModelReadOnlyViewSet):
@@ -371,22 +395,47 @@ class DeviceEncounterHistoryViewSet(EMRModelReadOnlyViewSet):
     def get_device(self):
         return get_object_or_404(Device, external_id=self.kwargs["device_external_id"])
 
-    def get_queryset(self):
-        """
-        Encounter history access is limited to everyone within the location or associated with the managing org
-        """
+    def authorize_retrieve(self, model_instance):
         device = self.get_device()
         if not AuthorizationController.call(
             "can_read_device",
             self.request.user,
             device,
         ):
             raise PermissionDenied("You do not have permission to access the device")
-        return (
-            DeviceEncounterHistory.objects.filter(device=device)
-            .select_related("encounter", "encounter__patient", "encounter__facility")
-            .order_by("-end")
+        if device.id != model_instance.device_id:
+            raise ValidationError(
+                "device does not match with the device encounter history"
+            )
+
+    def get_queryset(self):
+        """
+        Encounter history access is limited to everyone within the location or associated with the managing org
+        """
+        device = self.get_device()
+        queryset = (
+            super()
+            .get_queryset()
+            .select_related("created_by", "updated_by")
+            .order_by("-modified_date")
         )
+        if self.action == "list":
+            if not AuthorizationController.call(
+                "can_read_device",
+                self.request.user,
+                device,
+            ):
+                raise PermissionDenied(
+                    "You do not have permission to access the device"
+                )
+            return (
+                DeviceEncounterHistory.objects.filter(device=device)
+                .select_related(
+                    "encounter", "encounter__patient", "encounter__facility"
+                )
+                .order_by("-end")
+            )
+        return queryset
 
 
 class DeviceServiceHistoryViewSet(
@@ -421,6 +470,19 @@ def authorize_create(self, instance):
     def authorize_update(self, request_obj, model_instance):
         self.authorize_create(model_instance)
 
+    def authorize_retrieve(self, model_instance):
+        device = self.get_device()
+        if not AuthorizationController.call(
+            "can_read_device",
+            self.request.user,
+            device,
+        ):
+            raise PermissionDenied("You do not have permission to access the device")
+        if device.id != model_instance.device_id:
+            raise ValidationError(
+                "device does not match with the device service history"
+            )
+
     def perform_update(self, instance):
         if instance.edit_history and len(instance.edit_history) >= 50:  # noqa PLR2004
             raise ValidationError("Cannot Edit instance anymore")
@@ -441,15 +503,25 @@ def get_queryset(self):
         Encounter history access is limited to everyone within the location or associated with the managing org
         """
         device = self.get_device()
-        if not AuthorizationController.call(
-            "can_read_device",
-            self.request.user,
-            device,
-        ):
-            raise PermissionDenied("You do not have permission to access the device")
-        return DeviceServiceHistory.objects.filter(device=device).order_by(
-            "-serviced_on"
+        queryset = (
+            super()
+            .get_queryset()
+            .select_related("created_by", "updated_by")
+            .order_by("-modified_date")
         )
+        if self.action == "list":
+            if not AuthorizationController.call(
+                "can_read_device",
+                self.request.user,
+                device,
+            ):
+                raise PermissionDenied(
+                    "You do not have permission to access the device"
+                )
+            return DeviceServiceHistory.objects.filter(device=device).order_by(
+                "-serviced_on"
+            )
+        return queryset
 
 
 def disassociate_device_from_encounter(instance):

care/emr/api/viewsets/inventory/inventory_item.py

@@ -1,6 +1,6 @@
 from django.db.models import Q
 from django_filters import rest_framework as filters
-from rest_framework.exceptions import PermissionDenied
+from rest_framework.exceptions import PermissionDenied, ValidationError
 from rest_framework.filters import OrderingFilter
 
 from care.emr.api.viewsets.base import EMRBaseViewSet, EMRListMixin, EMRRetrieveMixin
@@ -46,19 +46,26 @@ def authorize_location_read(self, location):
             raise PermissionDenied("You do not have permission to read inventory items")
 
     def authorize_retrieve(self, model_instance):
+        location = self.get_location_obj()
         self.authorize_location_read(model_instance.location)
+        if location.id != model_instance.location.id:
+            raise ValidationError(
+                "Inventory item does not belong to the specified location"
+            )
 
     def get_queryset(self):
         queryset = super().get_queryset()
         location = self.get_location_obj()
-        self.authorize_location_read(location)
-        include_children = (
-            self.request.GET.get("include_children", "false").lower() == "true"
-        )
-        if include_children:
-            queryset = queryset.filter(
-                Q(location__parent_cache__overlap=[location.id]) | Q(location=location)
+        if self.action == "list":
+            self.authorize_location_read(location)
+            include_children = (
+                self.request.GET.get("include_children", "false").lower() == "true"
             )
-        else:
-            queryset = queryset.filter(location=location)
+            if include_children:
+                queryset = queryset.filter(
+                    Q(location__parent_cache__overlap=[location.id])
+                    | Q(location=location)
+                )
+            else:
+                queryset = queryset.filter(location=location)
         return queryset

care/emr/api/viewsets/location.py

@@ -303,6 +303,16 @@ def authorize_update(self, request_obj, model_instance):
     def authorize_destroy(self, instance):
         return self.authorize_create(instance)
 
+    def authorize_retrieve(self, model_instance):
+        location = self.get_location_obj()
+        facility = self.get_facility_obj()
+        if not AuthorizationController.call(
+            "can_list_facility_location_obj", self.request.user, facility, location
+        ):
+            raise PermissionDenied("You do not have permission to given location")
+        if location.id != model_instance.location.id:
+            raise ValidationError("Bed does not belong to the specified location")
+
     def reset_encounter_location_association(self, location):
         """
         Reset encounters to the right location.
@@ -488,14 +498,21 @@ def _validate_data(self, instance, model_obj=None):  # noqa PLR0912
     def get_queryset(self):
         location = self.get_location_obj()
         facility = self.get_facility_obj()
-        if not AuthorizationController.call(
-            "can_list_facility_location_obj", self.request.user, facility, location
-        ):
-            raise PermissionDenied("You do not have permission to given location")
-        return FacilityLocationEncounter.objects.filter(location=location).order_by(
-            "-created_date"
+        queryset = (
+            super()
+            .get_queryset()
+            .select_related("created_by", "updated_by")
+            .order_by("-modified_date")
         )
 
+        if self.action == "list":
+            if not AuthorizationController.call(
+                "can_list_facility_location_obj", self.request.user, facility, location
+            ):
+                raise PermissionDenied("You do not have permission to given location")
+            return queryset.filter(location=location).order_by("-created_date")
+        return queryset
+
 
 def close_related_location_from_encounter(instance):
     if instance.status in COMPLETED_CHOICES:

care/emr/api/viewsets/notes.py

@@ -120,10 +120,13 @@ def get_patient_obj(self):
             Patient, external_id=self.kwargs["patient_external_id"]
         )
 
-    def perform_create(self, instance):
-        instance.thread = get_object_or_404(
+    def get_thread_obj(self):
+        return get_object_or_404(
             NoteThread, external_id=self.kwargs["thread_external_id"]
         )
+
+    def perform_create(self, instance):
+        instance.thread = self.get_thread_obj()
         if encounter_id := self.request.data.get("encounter"):
             encounter = get_object_or_404(Encounter, external_id=encounter_id)
             if encounter.patient != instance.thread.patient:
@@ -138,9 +141,7 @@ def authorize_update(self, request_obj, model_instance):
         self.authorize_create({})
 
     def authorize_create(self, instance):
-        thread = get_object_or_404(
-            NoteThread, external_id=self.kwargs["thread_external_id"]
-        )
+        thread = self.get_thread_obj()
         if thread.encounter:
             allowed = AuthorizationController.call(
                 "can_update_encounter_clinical_data",
@@ -154,6 +155,11 @@ def authorize_create(self, instance):
         if not allowed:
             raise PermissionDenied("You do not have permission for this action")
 
+    def authorize_retrieve(self, model_instance):
+        thread = self.get_thread_obj()
+        if model_instance.thread != thread:
+            raise ValidationError("Message does not belong to the thread")
+
     def get_queryset(self):
         if not AuthorizationController.call(
             "can_view_clinical_data", self.request.user, self.get_patient_obj()
@@ -166,10 +172,13 @@ def get_queryset(self):
                     raise PermissionDenied("Permission denied to user")
             else:
                 raise PermissionDenied("Permission denied to user")
-
-        return (
+        thread = self.get_thread_obj()
+        queryset = (
             super()
             .get_queryset()
-            .filter(thread__external_id=self.kwargs["thread_external_id"])
-            .order_by("-created_date")
+            .select_related("created_by", "updated_by")
+            .order_by("-modified_date")
         )
+        if self.action == "list":
+            return queryset.filter(thread=thread).order_by("-created_date")
+        return queryset

care/emr/api/viewsets/organization.py

@@ -449,15 +449,34 @@ def authorize_create(self, instance):
         ):
             raise PermissionDenied("User does not have permission for this action")
 
-    def get_queryset(self):
-        """
-        Only users part of the organization can access its users
-        """
+    def authorize_retrieve(self, model_instance):
         organization = self.get_organization_obj()
         if not AuthorizationController.call(
             "can_list_organization_users_obj", self.request.user, organization
         ):
             raise PermissionDenied(
-                "User does not have the required permissions to list users"
+                "User does not have the required permission to read user"
             )
-        return OrganizationUser.objects.filter(organization=organization)
+        if model_instance.organization != organization:
+            raise ValidationError("User does not belong to the organization")
+
+    def get_queryset(self):
+        """
+        Only users part of the organization can access its users
+        """
+        organization = self.get_organization_obj()
+        queryset = (
+            super()
+            .get_queryset()
+            .select_related("created_by", "updated_by")
+            .order_by("-modified_date")
+        )
+        if self.action == "list":
+            if not AuthorizationController.call(
+                "can_list_organization_users_obj", self.request.user, organization
+            ):
+                raise PermissionDenied(
+                    "User does not have the required permission to list users"
+                )
+            return queryset.filter(organization=organization)
+        return queryset

care/emr/api/viewsets/scheduling/token.py

@@ -153,6 +153,8 @@ def authorize_retrieve(self, model_instance):
             self.request.user,
         ):
             raise PermissionDenied("You do not have permission to read token")
+        if queue != model_instance.queue:
+            raise ValidationError("Token does not belong to the specified queue")
 
     def get_queryset(self):
         _, queue = self.get_queue_obj()