Mask locations of inaccessible assets on map

flexmeasures/data/services/asset_grouping.py

@@ -4,11 +4,13 @@
 """
 
 from __future__ import annotations
-from typing import List, Dict, Optional
+from typing import List, Dict, Optional, Union
 import inflect
 
+from flask_security.core import current_user
 from sqlalchemy.orm import Query
 
+from flexmeasures.auth.policy import ADMIN_ROLE
 from flexmeasures.utils.flexmeasures_inflection import parameterize, pluralize
 from flexmeasures.data.models.generic_assets import (
     GenericAssetType,
@@ -28,7 +30,7 @@ def get_asset_group_queries(
     group_by_location: bool = False,
 ) -> Dict[str, Query]:
     """
-    An asset group is defined by Asset queries. Each query has a name, and we prefer pluralised  names.
+    An asset group is defined by Asset queries. Each query has a name, and we prefer pluralised names.
     They still need an executive call, like all(), count() or first().
 
     This function limits the assets to be queried to the current user's account,
@@ -56,6 +58,8 @@ def get_asset_group_queries(
     if group_by_location:
         asset_queries.update(get_location_queries())
 
+    asset_queries = mask_inaccessible_assets(asset_queries)
+
     return asset_queries
 
 
@@ -143,3 +147,24 @@ def parameterized_name(self) -> str:
 
     def __str__(self):
         return self.display_name
+
+
+def mask_inaccessible_assets(
+    asset_queries: Union[Query, Dict[str, Query]]
+) -> Union[Query, Dict[str, Query]]:
+    """Filter out any assets that the user should not be able to access.
+
+    We do not explicitly check user authentication here, because non-authenticated users are not admins
+    and have no asset ownership, so applying this filter for non-admins masks all assets.
+    """
+    if not current_user.has_role(ADMIN_ROLE):
+        if isinstance(asset_queries, dict):
+            for name, query in asset_queries.items():
+                asset_queries[name] = query.filter(
+                    GenericAsset.owner == current_user.account
+                )
+        else:
+            asset_queries = asset_queries.filter(
+                GenericAsset.owner == current_user.account
+            )
+    return asset_queries