# HG changeset patch
# User Goffi <goffi@goffi.org>
# Date 1634911464 -7200
# Node ID e739600267cd813a851f6960c8ca852ed516d317
# Parent  095e94ca6728807b2351eec953536e2c0faae00b
server (restricted_bridge): don't allow bridge methods modifying anything with service profile

diff -r 095e94ca6728 -r e739600267cd libervia/server/restricted_bridge.py
--- a/libervia/server/restricted_bridge.py	Fri Oct 22 16:04:23 2021 +0200
+++ b/libervia/server/restricted_bridge.py	Fri Oct 22 16:04:24 2021 +0200
@@ -16,8 +16,9 @@
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
+from sat.tools.common import data_format
+from sat.core import exceptions
 from libervia.server.constants import Const as C
-from sat.tools.common import data_format
 
 
 class RestrictedBridge:
@@ -31,6 +32,13 @@
         self.host = host
         self.security_limit = C.SECURITY_LIMIT
 
+    def noServiceProfile(self, profile):
+        """Raise an error if service profile is used"""
+        if profile == C.SERVICE_PROFILE:
+            raise exceptions.PermissionError(
+                "This action is not allowed for service profile"
+            )
+
     async def getContacts(self, profile):
         return await self.host.bridgeCall("getContacts", profile)
 
@@ -47,14 +55,17 @@
             "identitiesBaseGet", profile)
 
     async def psNodeDelete(self, service_s, node, profile):
+        self.noServiceProfile(profile)
         return await self.host.bridgeCall(
             "psNodeDelete", service_s, node, profile)
 
     async def psNodeAffiliationsSet(self, service_s, node, affiliations, profile):
+        self.noServiceProfile(profile)
         return await self.host.bridgeCall(
             "psNodeAffiliationsSet", service_s, node, affiliations, profile)
 
     async def psItemRetract(self, service_s, node, item_id, notify, profile):
+        self.noServiceProfile(profile)
         return await self.host.bridgeCall(
             "psItemRetract", service_s, node, item_id, notify, profile)
 
@@ -63,24 +74,28 @@
             "mbPreview", service_s, node, data, profile)
 
     async def listSet(self, service_s, node, values, schema, item_id, extra, profile):
+        self.noServiceProfile(profile)
         return await self.host.bridgeCall(
             "listSet", service_s, node, values, "", item_id, "", profile)
 
 
     async def fileHTTPUploadGetSlot(
         self, filename, size, content_type, upload_jid, profile):
+        self.noServiceProfile(profile)
         return await self.host.bridgeCall(
             "fileHTTPUploadGetSlot", filename, size, content_type,
             upload_jid, profile)
 
     async def fileSharingDelete(
         self, service_jid, path, namespace, profile):
+        self.noServiceProfile(profile)
         return await self.host.bridgeCall(
             "fileSharingDelete", service_jid, path, namespace, profile)
 
     async def interestsRegisterFileSharing(
         self, service, repos_type, namespace, path, name, extra_s, profile
     ):
+        self.noServiceProfile(profile)
         if extra_s:
             # we only allow "thumb_url" here
             extra = data_format.deserialise(extra_s)
@@ -97,12 +112,14 @@
     async def interestRetract(
         self, service_jid, item_id, profile
     ):
+        self.noServiceProfile(profile)
         return await self.host.bridgeCall(
             "interestRetract", service_jid, item_id, profile)
 
     async def psInvite(
         self, invitee_jid_s, service_s, node, item_id, name, extra_s, profile
     ):
+        self.noServiceProfile(profile)
         return await self.host.bridgeCall(
             "psInvite", invitee_jid_s, service_s, node, item_id, name, extra_s, profile
         )
@@ -111,6 +128,7 @@
         self, invitee_jid_s, service_s, repos_type, namespace, path, name, extra_s,
         profile
     ):
+        self.noServiceProfile(profile)
         if extra_s:
             # we only allow "thumb_url" here
             extra = data_format.deserialise(extra_s)
@@ -127,6 +145,7 @@
     async def FISAffiliationsSet(
         self, service_s, namespace, path, affiliations, profile
     ):
+        self.noServiceProfile(profile)
         return await self.host.bridgeCall(
             "FISAffiliationsSet", service_s, namespace, path, affiliations, profile
         )
@@ -134,6 +153,7 @@
     async def invitationSimpleCreate(
         self, invitee_email, invitee_name, url_template, extra_s, profile
     ):
+        self.noServiceProfile(profile)
         return await self.host.bridgeCall(
             "invitationSimpleCreate", invitee_email, invitee_name, url_template, extra_s,
             profile