validation

Author: pcrespov

packages/models-library/src/models_library/access_rights.py

@@ -10,6 +10,16 @@ class AccessRights(BaseModel):
 
     model_config = ConfigDict(extra="forbid")
 
+    def check_access_constraints(self):
+        """Helper function that checks extra constraints in access-rights flags"""
+        if self.write and not self.read:
+            msg = "Write access requires read access"
+            raise ValueError(msg)
+        if self.delete and not self.write:
+            msg = "Delete access requires read access"
+            raise ValueError(msg)
+        return self
+
 
 class ExecutableAccessRights(BaseModel):
     write: Annotated[bool, Field(description="can change executable settings")]

packages/models-library/src/models_library/api_schemas_webserver/projects_access_rights.py

@@ -1,7 +1,8 @@
-from typing import Annotated
+from typing import Annotated, Self
 
 from models_library.groups import GroupID
 from models_library.projects import ProjectID
+from pydantic import model_validator  # Added for validation
 from pydantic import (
     BaseModel,
     ConfigDict,
@@ -10,12 +11,14 @@
     StringConstraints,
 )
 
+from ..access_rights import AccessRights
 from ._base import InputSchema, OutputSchema
 
 
 class ProjectsGroupsPathParams(BaseModel):
     project_id: ProjectID
     group_id: GroupID
+
     model_config = ConfigDict(extra="forbid")
 
 
@@ -36,6 +39,13 @@ class ProjectShare(InputSchema):
     write: bool
     delete: bool
 
+    @model_validator(mode="after")
+    def check_access_constraints(self) -> Self:
+        AccessRights(
+            read=self.read, write=self.write, delete=self.delete
+        ).check_access_constraints()
+        return self
+
 
 class ProjectShareAccepted(OutputSchema):
     sharee_email: EmailStr