fix(serializer): remove unnecessary fields for non-permitted users

cds/modules/records/serializers/json.py

@@ -21,18 +21,18 @@
 # or submit itself to any jurisdiction.
 """CDS JSON Serializer."""
 
-
 from flask import has_request_context
 from flask_security import current_user
 from invenio_records_rest.serializers.json import JSONSerializer
+from marshmallow_utils.html import ALLOWED_CSS_STYLES, ALLOWED_HTML_ATTRS, sanitize_html
 
 from ..api import CDSRecord
 from ..permissions import (
     has_read_record_eos_path_permission,
     has_read_record_permission,
+    has_update_permission,
 )
 from ..utils import HTMLTagRemover, parse_video_chapters
-from marshmallow_utils.html import sanitize_html, ALLOWED_HTML_ATTRS, ALLOWED_CSS_STYLES
 
 CUSTOM_ALLOWED_ATTRS = {
     **ALLOWED_HTML_ATTRS,
@@ -89,6 +89,14 @@ def _sanitize_metadata(self, metadata):
 
         return metadata
 
+    def _remove_internal_fields(self, record, metadata):
+        """Remove _access from the metadata if the user doesn't have update permissions on the record."""
+        if not has_update_permission(current_user, record):
+            metadata.pop("_access", None)
+            metadata.pop("_buckets", None)
+            metadata.pop("_cds", None)
+        return metadata
+
     def preprocess_record(self, pid, record, links_factory=None):
         """Include ``_eos_library_path`` for single record retrievals."""
         result = super(CDSJSONSerializer, self).preprocess_record(
@@ -106,6 +114,7 @@ def preprocess_record(self, pid, record, links_factory=None):
             # sanitize title by unescaping and stripping html tags
             try:
                 metadata = self._sanitize_metadata(metadata)
+                metadata = self._remove_internal_fields(record, metadata)
                 if has_request_context():
                     metadata["videos"] = [
                         video
@@ -134,5 +143,8 @@ def preprocess_search_hit(self, pid, record_hit, links_factory=None):
         if "metadata" in result:
             metadata = result["metadata"]
             result["metadata"] = self._sanitize_metadata(result["metadata"])
+            result["metadata"] = self._remove_internal_fields(
+                record_hit, result["metadata"]
+            )
 
         return result

docker-services.yml

@@ -112,8 +112,6 @@ services:
     image: opensearchproject/opensearch-dashboards:2
     ports:
       - "${DOCKER_SERVICES_IP_BIND:-127.0.0.1}:5601:5601"
-    expose:
-      - "${DOCKER_SERVICES_IP_BIND:-127.0.0.1}:5601"
     environment:
       # settings only for development. DO NOT use in production!
       - 'OPENSEARCH_HOSTS=["http://search:9200"]'

tests/unit/test_serializer.py

@@ -173,6 +173,16 @@ def test_cds_json_serializer_sanitization(video_record_metadata):
             'title': {'title': '<script>alert("bad")</script> Titre'}
         }
     ]
+
+    record["_access"] = {
+        "key": "value"
+    }
+    record["_buckets"] = {
+        "key":"value"
+    }
+    record["_cds"] = {
+        "key":"value"
+    }
 
     # Test the serializer
     serializer = CDSJSONSerializer()
@@ -201,3 +211,7 @@ def test_cds_json_serializer_sanitization(video_record_metadata):
     translations = result['metadata']['translations']
     for tr in translations:
         assert '<script>' not in tr['description']
+
+    assert "_access" not in result
+    assert "_buckets" not in result
+    assert "_cds" not in result