Merge pull request #1493 from bookwyrm-social/auth-search

Logged out users can't search remote sources

bookwyrm/tests/views/test_search.py

@@ -51,7 +51,7 @@ class Views(TestCase):
         data = json.loads(response.content)
         self.assertEqual(len(data), 1)
         self.assertEqual(data[0]["title"], "Test Book")
-        self.assertEqual(data[0]["key"], "https://%s/book/%d" % (DOMAIN, self.book.id))
+        self.assertEqual(data[0]["key"], f"https://{DOMAIN}/book/{self.book.id}")
 
     def test_search_no_query(self):
         """just the search page"""
@@ -91,12 +91,27 @@ class Views(TestCase):
         self.assertIsInstance(response, TemplateResponse)
         response.render()
         connector_results = response.context_data["results"]
+        self.assertEqual(len(connector_results), 2)
         self.assertEqual(connector_results[0]["results"][0].title, "Test Book")
         self.assertEqual(
             connector_results[1]["results"][0].title,
             "This Is How You Lose the Time War",
         )
 
+        # don't search remote
+        request = self.factory.get("", {"q": "Test Book", "remote": True})
+        anonymous_user = AnonymousUser
+        anonymous_user.is_authenticated = False
+        request.user = anonymous_user
+        with patch("bookwyrm.views.search.is_api_request") as is_api:
+            is_api.return_value = False
+            response = view(request)
+        self.assertIsInstance(response, TemplateResponse)
+        response.render()
+        connector_results = response.context_data["results"]
+        self.assertEqual(len(connector_results), 1)
+        self.assertEqual(connector_results[0]["results"][0].title, "Test Book")
+
     def test_search_users(self):
         """searches remote connectors"""
         view = views.Search.as_view()

bookwyrm/views/books/books.py

@@ -172,6 +172,7 @@ def add_description(request, book_id):
     return redirect("book", book.id)
 
 
+@login_required
 @require_POST
 def resolve_book(request):
     """figure out the local path to a book from a remote_id"""

bookwyrm/views/search.py

@@ -67,11 +67,11 @@ class Search(View):
         return TemplateResponse(request, f"search/{search_type}.html", data)
 
 
-def book_search(query, _, min_confidence, search_remote=False):
+def book_search(query, user, min_confidence, search_remote=False):
     """the real business is elsewhere"""
     # try a local-only search
     results = [{"results": search(query, min_confidence=min_confidence)}]
-    if results and not search_remote:
+    if not user.is_authenticated or (results[0]["results"] and not search_remote):
         return results, False
 
     # if there were no local results, or the request was for remote, search all sources