Update

devplacepy/services/devii/container/controller.py

@@ -45,14 +45,22 @@ class ContainerController:
         }
 
     def _project(self, arguments: dict) -> dict:
-        from devplacepy.content import can_view_project
+        from devplacepy.content import can_view_project_containers
 
         slug = str(arguments.get("project_slug", "")).strip()
         project = resolve_by_slug(get_table("projects"), slug) if slug else None
-        if not project or not can_view_project(project, self._actor_user()):
+        if not project or not can_view_project_containers(project, self._actor_user()):
             raise ToolInputError(f"project not found: {slug}")
         return project
 
+    def _require_manage(self, project: dict, inst: dict) -> None:
+        from devplacepy.content import can_manage_instance
+
+        if not can_manage_instance(inst, project, self._actor_user()):
+            raise ToolInputError(
+                "only the container owner or the primary administrator can manage this instance"
+            )
+
     def _instance(self, project: dict, ref: str) -> dict:
         inst = store.get_instance(ref)
         if inst is None or inst["project_uid"] != project["uid"]:
@@ -121,6 +129,7 @@ class ContainerController:
     async def _instance_action(self, arguments) -> str:
         project = self._project(arguments)
         inst = self._instance(project, str(arguments.get("instance", "")))
+        self._require_manage(project, inst)
         action = str(arguments.get("action", "")).lower()
         actor = ("user", self._actor_user()["uid"])
         if action == "delete":
@@ -143,6 +152,7 @@ class ContainerController:
     async def _configure_instance(self, arguments) -> str:
         project = self._project(arguments)
         inst = self._instance(project, str(arguments.get("instance", "")))
+        self._require_manage(project, inst)
         actor = ("user", self._actor_user()["uid"])
         kwargs: dict = {}
         for key in (
@@ -188,6 +198,7 @@ class ContainerController:
     async def _exec(self, arguments) -> str:
         project = self._project(arguments)
         inst = self._instance(project, str(arguments.get("instance", "")))
+        self._require_manage(project, inst)
         if not inst.get("container_id"):
             raise ToolInputError("instance is not running")
         command = str(arguments.get("command", "")).strip()
@@ -223,6 +234,7 @@ class ContainerController:
     async def _schedule(self, arguments) -> str:
         project = self._project(arguments)
         inst = self._instance(project, str(arguments.get("instance", "")))
+        self._require_manage(project, inst)
         run_at = arguments.get("run_at")
         try:
             schedule = Schedule(