fix(serializer): remove unnecessary fields for non-permitted users

Author: palkerecsenyi

cds/modules/records/serializers/json.py

@@ -21,18 +21,18 @@
 # or submit itself to any jurisdiction.
 """CDS JSON Serializer."""
 
-
 from flask import has_request_context
 from flask_security import current_user
 from invenio_records_rest.serializers.json import JSONSerializer
+from marshmallow_utils.html import ALLOWED_CSS_STYLES, ALLOWED_HTML_ATTRS, sanitize_html
 
 from ..api import CDSRecord
 from ..permissions import (
     has_read_record_eos_path_permission,
     has_read_record_permission,
+    has_update_permission,
 )
 from ..utils import HTMLTagRemover, parse_video_chapters
-from marshmallow_utils.html import sanitize_html, ALLOWED_HTML_ATTRS, ALLOWED_CSS_STYLES
 
 CUSTOM_ALLOWED_ATTRS = {
     **ALLOWED_HTML_ATTRS,
@@ -89,6 +89,15 @@ def _sanitize_metadata(self, metadata):
 
         return metadata
 
+    def _remove_access(self, record, metadata):
+        """Remove _access from the metadata if the user doesn't have update permissions on the record."""
+        if "_access" in metadata and not has_update_permission(current_user, record):
+            metadata.pop("_access")
+            metadata.pop("_buckets")
+            metadata.pop("_cds")
+            metadata.pop("_deposit")
+        return metadata
+
     def preprocess_record(self, pid, record, links_factory=None):
         """Include ``_eos_library_path`` for single record retrievals."""
         result = super(CDSJSONSerializer, self).preprocess_record(
@@ -106,6 +115,7 @@ def preprocess_record(self, pid, record, links_factory=None):
             # sanitize title by unescaping and stripping html tags
             try:
                 metadata = self._sanitize_metadata(metadata)
+                metadata = self._remove_access(record, metadata)
                 if has_request_context():
                     metadata["videos"] = [
                         video
@@ -134,5 +144,6 @@ def preprocess_search_hit(self, pid, record_hit, links_factory=None):
         if "metadata" in result:
             metadata = result["metadata"]
             result["metadata"] = self._sanitize_metadata(result["metadata"])
+            result["metadata"] = self._remove_access(record_hit, result["metadata"])
 
         return result