Add `can_write` to /collection/:id/items (#42184)

For dashboards and cards/models only.

src/metabase/api/collection.clj

@@ -470,7 +470,8 @@
       true)))
 
 (defn- post-process-card-row [row]
-  (-> row
+  (-> (t2/instance :model/Card row)
+      (t2/hydrate :can_write)
       (dissoc :authority_level :icon :personal_owner_id :dataset_query :table_id :query_type :is_upload)
       (update :collection_preview api/bit->boolean)
       (assoc :fully_parameterized (fully-parameterized-query? row))))
@@ -502,12 +503,15 @@
   [_ collection options]
   (dashboard-query collection options))
 
+(defn- post-process-dashboard [dashboard]
+  (-> (t2/instance :model/Dashboard dashboard)
+      (t2/hydrate :can_write)
+      (dissoc :display :authority_level :moderated_status :icon :personal_owner_id :collection_preview
+              :dataset_query :table_id :query_type :is_upload)))
+
 (defmethod post-process-collection-children :dashboard
   [_ _ rows]
-  (map #(dissoc %
-                :display :authority_level :moderated_status :icon :personal_owner_id :collection_preview
-                :dataset_query :table_id :query_type :is_upload)
-       rows))
+  (map post-process-dashboard rows))
 
 (defenterprise snippets-collection-filter-clause
   "Clause to filter out snippet collections from the collection query on OSS instances, and instances without the

test/metabase/api/collection_test.clj

@@ -648,6 +648,7 @@
                                                                         :most_recent         true}]
         (is (= (mt/obj->json->obj
                 [{:collection_id       (:id collection)
+                  :can_write           true
                   :id                  card-id
                   :location            nil
                   :name                (:name card)
@@ -1992,3 +1993,22 @@
                                        (assoc (graph/graph)
                                               :groups {group-id {default-a :write, currency-a :write}}
                                               :namespace :currency)))))))))
+
+(deftest cards-and-dashboards-get-can-write
+  (t2.with-temp/with-temp [:model/Collection {collection-id :id :as collection} {}
+                           :model/Card _ {:collection_id collection-id}
+                           :model/Dashboard _ {:collection_id collection-id}
+                           :model/Card _ {:collection_id collection-id
+                                          :type :model}]
+
+    (testing "`can_write` is `true` when appropriate"
+      (perms/revoke-collection-permissions! (perms-group/all-users) collection)
+      (perms/grant-collection-readwrite-permissions! (perms-group/all-users) collection)
+      (is (= #{[true "card"] [true "dataset"] [true "dashboard"]}
+             (into #{} (map (juxt :can_write :model) (:data (mt/user-http-request :rasta :get 200 (str "collection/" collection-id "/items"))))))))
+
+    (testing "and `false` when appropriate"
+      (perms/revoke-collection-permissions! (perms-group/all-users) collection)
+      (perms/grant-collection-read-permissions! (perms-group/all-users) collection)
+      (is (= #{[false "card"] [false "dataset"] [false "dashboard"]}
+             (into #{} (map (juxt :can_write :model) (:data (mt/user-http-request :rasta :get 200 (str "collection/" collection-id "/items"))))))))))