From 1af24ffcfebcd923736cbad97a75c22824bccf9d Mon Sep 17 00:00:00 2001
From: Matthias Dellweg <mdellweg@redhat.com>
Date: Wed, 6 Sep 2023 15:57:09 +0200
Subject: [PATCH] Adjust access policies for labels

fixes #1384
---
 CHANGES/1384.feature           | 1 +
 pulp_container/app/viewsets.py | 8 ++++----
 2 files changed, 5 insertions(+), 4 deletions(-)
 create mode 100644 CHANGES/1384.feature

diff --git a/CHANGES/1384.feature b/CHANGES/1384.feature
new file mode 100644
index 000000000..e8c8c55e6
--- /dev/null
+++ b/CHANGES/1384.feature
@@ -0,0 +1 @@
+Adjusted default access policies for new labels API.
diff --git a/pulp_container/app/viewsets.py b/pulp_container/app/viewsets.py
index 7dc2b1155..4a4501a1f 100644
--- a/pulp_container/app/viewsets.py
+++ b/pulp_container/app/viewsets.py
@@ -381,7 +381,7 @@ class ContainerRemoteViewSet(RemoteViewSet, RolesMixin):
                 "condition": "has_model_or_obj_perms:container.view_containerremote",
             },
             {
-                "action": ["update", "partial_update"],
+                "action": ["update", "partial_update", "set_label", "unset_label"],
                 "principal": "authenticated",
                 "effect": "allow",
                 "condition": [
@@ -579,7 +579,7 @@ class ContainerRepositoryViewSet(
                 ],
             },
             {
-                "action": ["update", "partial_update"],
+                "action": ["update", "partial_update", "set_label", "unset_label"],
                 "principal": "authenticated",
                 "effect": "allow",
                 "condition": [
@@ -968,7 +968,7 @@ class ContainerPushRepositoryViewSet(
                 ],
             },
             {
-                "action": ["update", "partial_update"],
+                "action": ["update", "partial_update", "set_label", "unset_label"],
                 "principal": "authenticated",
                 "effect": "allow",
                 "condition_expression": [
@@ -1172,7 +1172,7 @@ class ContainerDistributionViewSet(DistributionViewSet, RolesMixin):
                 ],
             },
             {
-                "action": ["update", "partial_update"],
+                "action": ["update", "partial_update", "set_label", "unset_label"],
                 "principal": "authenticated",
                 "effect": "allow",
                 "condition": [