fix: protect API endpoints of pdf-extractor

sonar/modules/pdf_extractor/views/api.py

@@ -7,6 +7,7 @@
 
 from sonar.modules.pdf_extractor.pdf_extractor import PDFExtractor
 from sonar.modules.pdf_extractor.utils import extract_text_from_content
+from sonar.modules.permissions import is_user_logged_and_submitter
 
 api_blueprint = Blueprint(
     "pdf_extractor",
@@ -18,6 +19,7 @@
 
 
 @api_blueprint.route("/metadata", methods=["POST"])
+@is_user_logged_and_submitter
 def metadata():
     """Extract PDF metadata and return as a json object."""
     try:
@@ -36,6 +38,7 @@ def metadata():
 
 
 @api_blueprint.route("/full-text", methods=["POST"])
+@is_user_logged_and_submitter
 def full_text():
     """Extract PDF metadata and return as a json object."""
     try:

sonar/modules/pdf_extractor/views/client.py

@@ -4,7 +4,8 @@
 """API Views."""
 
 from flask import Blueprint, render_template
-from flask_login import login_required
+
+from sonar.modules.permissions import is_user_logged_and_submitter
 
 blueprint = Blueprint(
     "pdf",
@@ -16,7 +17,7 @@
 
 
 @blueprint.route("/test", methods=["GET"])
-@login_required
+@is_user_logged_and_submitter
 def test():
     """Test upload file and extracting metadata."""
     return render_template("test.html")

tests/ui/pdf_extractor/test_pdf_extractor_views_api.py

@@ -6,13 +6,21 @@
 import json
 from io import BytesIO
 
+from invenio_accounts.testutils import login_user_via_session
 from invenio_app.factory import create_api
 
 create_app = create_api
 
 
-def test_metadata(client, pdf_file, mock_grobid_response):
+def test_metadata(client, user, submitter, pdf_file, mock_grobid_response):
     """Test metadata extraction."""
+    # A submitter is required.
+    assert client.post("/pdf-extractor/metadata").status_code == 401
+    login_user_via_session(client, email=user["email"])
+    assert client.post("/pdf-extractor/metadata").status_code == 403
+
+    login_user_via_session(client, email=submitter["email"])
+
     response = client.post("/pdf-extractor/metadata")
     assert response.status_code == 400
 
@@ -30,8 +38,15 @@ def test_metadata(client, pdf_file, mock_grobid_response):
     assert title[:10] == "High-harmo"
 
 
-def test_full_text(client, pdf_file):
+def test_full_text(client, user, submitter, pdf_file):
     """Test full text extraction."""
+    # A submitter is required.
+    assert client.post("/pdf-extractor/full-text").status_code == 401
+    login_user_via_session(client, email=user["email"])
+    assert client.post("/pdf-extractor/full-text").status_code == 403
+
+    login_user_via_session(client, email=submitter["email"])
+
     response = client.post("/pdf-extractor/full-text")
     assert response.status_code == 400
 

tests/ui/pdf_extractor/test_pdf_extractor_views_client.py

@@ -3,13 +3,18 @@
 
 """Test client views for PDF extractor."""
 
-from invenio_accounts.testutils import login_user_via_view
+from invenio_accounts.testutils import login_user_via_session
 
 
-def test_pdf_extractor_test_page(client, user):
+def test_pdf_extractor_test_page(client, user, submitter):
     """Test the PDF extractor test page."""
-    login_user_via_view(client, email=user["email"], password="123456")
+    # A submitter is required.
+    assert client.get("/pdf-extractor/test").status_code == 401
 
+    login_user_via_session(client, email=user["email"])
+    assert client.get("/pdf-extractor/test").status_code == 403
+
+    login_user_via_session(client, email=submitter["email"])
     response = client.get("/pdf-extractor/test")
     assert response.status_code == 200
     assert "PDF metadata extraction" in str(response.data)