fix: align disk settings auth with DocType permissions

[safwansamsudeen]

Summary

• Remove unused jwt_key from Drive Disk Settings (file auth uses Drive Token instead).
• Grant Drive Admin read/write on the Drive Disk Settings single DocType.
• Add is_drive_site_admin() so disk_settings and is_site_admin check Administrator or has_permission("Drive Disk Settings", "write"), keeping API access aligned with DocType permissions.

Test plan

• Run bench migrate on an existing site and confirm jwt_key column is dropped
• As a guest/unauthenticated user, GET disk_settings returns only preview_size and enabled
• As Administrator, Storage settings tab is visible and PUT saves successfully
• As System Manager, Storage settings tab is visible and PUT saves successfully
• As a user with Drive Admin role, Storage settings tab is visible and PUT saves successfully
• As a regular Drive user without write permission, Storage settings tab is hidden and PUT does not update settings

Made with Cursor

[greptile-apps]

Confidence Score: 5/5

Safe to merge — the permission gate is correctly delegated to Frappe's built-in has_permission(), which already handles Administrator, and the allow_guest path short-circuits before any sensitive data is returned.

The change is a straightforward permission-model alignment. The guest-accessible endpoint correctly gates sensitive fields behind a write-permission check, the helper function relies on Frappe's own permission engine rather than manual role-name comparisons, and the DocType JSON adds the expected role entry without widening access beyond what the PR intends.

No files require special attention. The only pre-migration concern is the jwt_key column drop, which the test plan already covers.

Important Files Changed

Filename	Overview
drive/api/product.py	Replaces role-name guard with frappe.has_permission() for both is_site_admin and disk_settings; logic is correct and the allow_guest=True path safely short-circuits for non-admins.
drive/drive/doctype/drive_disk_settings/drive_disk_settings.json	Adds Drive Admin role with full DocType permissions; removes jwt_key field definition. Migration required to drop the column.

Sequence Diagram

%%{init: {'theme': 'neutral'}}%%
sequenceDiagram
    participant C as Client
    participant API as disk_settings()
    participant P as is_drive_site_admin()
    participant F as frappe.has_permission()
    participant DS as Drive Disk Settings

    C->>API: GET/PUT /disk_settings
    API->>DS: frappe.get_single("Drive Disk Settings")
    DS-->>API: settings doc
    API->>P: is_drive_site_admin()
    P->>F: has_permission("Drive Disk Settings", "write")
    F-->>P: True / False
    P-->>API: True / False

    alt Non-admin / Guest
        API-->>C: "{preview_size, enabled}"
    else Admin (Drive Admin / System Manager / Administrator)
        alt GET
            API-->>C: full settings doc
        else PUT
            API->>DS: setattr fields + settings.save()
            DS-->>API: saved
            API-->>C: (implicit None)
        end
    end

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
sequenceDiagram
    participant C as Client
    participant API as disk_settings()
    participant P as is_drive_site_admin()
    participant F as frappe.has_permission()
    participant DS as Drive Disk Settings

    C->>API: GET/PUT /disk_settings
    API->>DS: frappe.get_single("Drive Disk Settings")
    DS-->>API: settings doc
    API->>P: is_drive_site_admin()
    P->>F: has_permission("Drive Disk Settings", "write")
    F-->>P: True / False
    P-->>API: True / False

    alt Non-admin / Guest
        API-->>C: "{preview_size, enabled}"
    else Admin (Drive Admin / System Manager / Administrator)
        alt GET
            API-->>C: full settings doc
        else PUT
            API->>DS: setattr fields + settings.save()
            DS-->>API: saved
            API-->>C: (implicit None)
        end
    end

Loading

_{Reviews (2): Last reviewed commit: "fix: remove redundant check" | Re-trigger Greptile}