Merge pull request #4024 from mathesar-foundation/cng_perms_for_db_dc

Allow only superusers to disconnect configured DBs
mathesar-foundation · Nov 13, 2024 · 08e9c26 · 08e9c26
2 parents 5992623 + 27b5326
commit 08e9c26
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 3 deletions.
diff --git a/mathesar/rpc/databases/configured.py b/mathesar/rpc/databases/configured.py
@@ -1,7 +1,7 @@
 from typing import TypedDict
 
 from modernrpc.core import rpc_method, REQUEST_KEY
-from modernrpc.auth.basic import http_basic_auth_login_required
+from modernrpc.auth.basic import http_basic_auth_login_required, http_basic_auth_superuser_required
 
 from mathesar.models.base import Database
 from mathesar.rpc.exceptions.handlers import handle_rpc_exceptions
@@ -69,7 +69,7 @@ def list_(*, server_id: int = None, **kwargs) -> list[ConfiguredDatabaseInfo]:
 
 
 @rpc_method(name="databases.configured.disconnect")
-@http_basic_auth_login_required
+@http_basic_auth_superuser_required
 @handle_rpc_exceptions
 def disconnect(*, database_id: int, **kwargs) -> None:
     """

diff --git a/mathesar/tests/rpc/test_endpoints.py b/mathesar/tests/rpc/test_endpoints.py
@@ -145,7 +145,7 @@
     (
         databases.configured.disconnect,
         "databases.configured.disconnect",
-        [user_is_authenticated]
+        [user_is_superuser]
     ),
 
     (