repo-api: allow repo admins to get/set settings. Previously it was only super-admins that could do that, and it's wrong.

rhodecode/api/utils.py

@@ -170,8 +170,7 b' def validate_repo_permissions(apiuser, r'
     """
     if not HasRepoPermissionAnyApi(*perms)(
             user=apiuser, repo_name=repo.repo_name):
-        raise JSONRPCError(
-            'repository `%s` does not exist' % repoid)
+        raise JSONRPCError('repository `%s` does not exist' % repoid)
 
     return True
 

rhodecode/api/views/repo_api.py

@@ -307,8 +307,7 b' def get_repo_changeset(request, apiuser,'
     """
     repo = get_repo_or_error(repoid)
     if not has_superadmin_permission(apiuser):
-        _perms = (
-            'repository.admin', 'repository.write', 'repository.read',)
+        _perms = ('repository.admin', 'repository.write', 'repository.read',)
         validate_repo_permissions(apiuser, repoid, repo, _perms)
 
     changes_details = Optional.extract(details)
@@ -366,8 +365,7 b' def get_repo_changesets(request, apiuser'
     """
     repo = get_repo_or_error(repoid)
     if not has_superadmin_permission(apiuser):
-        _perms = (
-            'repository.admin', 'repository.write', 'repository.read',)
+        _perms = ('repository.admin', 'repository.write', 'repository.read',)
         validate_repo_permissions(apiuser, repoid, repo, _perms)
 
     changes_details = Optional.extract(details)
@@ -1021,7 +1019,8 b' def update_repo('
 
     include_secrets = False
     if not has_superadmin_permission(apiuser):
-        validate_repo_permissions(apiuser, repoid, repo, ('repository.admin',))
+        _perms = ('repository.admin',)
+        validate_repo_permissions(apiuser, repoid, repo, _perms)
     else:
         include_secrets = True
 
@@ -1208,8 +1207,7 b' def fork_repo(request, apiuser, repoid, '
     if not has_superadmin_permission(apiuser):
         # check if we have at least read permission for
         # this repo that we fork !
-        _perms = (
-            'repository.admin', 'repository.write', 'repository.read')
+        _perms = ('repository.admin', 'repository.write', 'repository.read')
         validate_repo_permissions(apiuser, repoid, repo, _perms)
 
         # check if the regular user has at least fork permissions as well
@@ -2370,12 +2368,13 b' def get_repo_settings(request, apiuser, '
         }
     """
 
-    # Restrict access to this api method to admins only.
+    # Restrict access to this api method to super-admins, and repo admins only.
+    repo = get_repo_or_error(repoid)
     if not has_superadmin_permission(apiuser):
-        raise JSONRPCForbidden()
+        _perms = ('repository.admin',)
+        validate_repo_permissions(apiuser, repoid, repo, _perms)
 
     try:
-        repo = get_repo_or_error(repoid)
         settings_model = VcsSettingsModel(repo=repo)
         settings = settings_model.get_global_settings()
         settings.update(settings_model.get_repo_settings())
@@ -2414,9 +2413,11 b' def set_repo_settings(request, apiuser, '
             "result": true
         }
     """
-    # Restrict access to this api method to admins only.
+    # Restrict access to this api method to super-admins, and repo admins only.
+    repo = get_repo_or_error(repoid)
     if not has_superadmin_permission(apiuser):
-        raise JSONRPCForbidden()
+        _perms = ('repository.admin',)
+        validate_repo_permissions(apiuser, repoid, repo, _perms)
 
     if type(settings) is not dict:
         raise JSONRPCError('Settings have to be a JSON Object.')