Version Filtering only Applies to List

src/olympia/addons/tests/test_views.py

@@ -4369,6 +4369,25 @@ def test_restriction_instance_recorded_on_auto_approval_denial(self):
         )
         assert self.addon.auto_approval_disabled_unlisted
 
+    def test_filters_permissions_only_for_list_action(self):
+        reviewer = user_factory(read_dev_agreement=self.days_ago(0))
+        self.grant_permission(reviewer, amo.permissions.ADDONS_API_VIEW)
+        self.client.login_api(reviewer)
+        response = self.client.post(self.url, data={**self.minimal_data})
+        assert response.status_code == 403
+
+        response = self.client.post(
+            f'{self.url}?filter=all_without_unlisted', data={**self.minimal_data}
+        )
+        assert response.status_code == 403
+
+        # No problem for author.
+        self.client.login_api(self.user)
+        response = self.client.post(
+            f'{self.url}?filter=all_without_unlisted', data={**self.minimal_data}
+        )
+        assert response.status_code == 201
+
 
 class TestVersionViewSetCreateJWTAuth(TestVersionViewSetCreate):
     client_class = APITestClientJWT

src/olympia/addons/views.py

@@ -607,7 +607,13 @@ def get_serializer(self, *args, **kwargs):
     def check_permissions(self, request):
         # if a filter is used we override and downscope permissions
         requested = self.request.GET.get('filter')
-        if requested == 'all_with_deleted':
+
+        # None will just use the permission_classes for the addon
+        permission_classes = None
+
+        if self.action != 'list':
+            pass
+        elif requested == 'all_with_deleted':
             # To see deleted versions, you need Addons:ApiViewDeleted.
             permission_classes = [
                 GroupPermission(amo.permissions.ADDONS_API_VIEW_DELETED)
@@ -628,9 +634,6 @@ def check_permissions(self, request):
             permission_classes = [
                 AllowAddonAuthor | GroupPermission(amo.permissions.ADDONS_API_VIEW)
             ]
-        else:
-            # None will just use the permission_classes for the addon
-            permission_classes = None
 
         # Getting the parent add-on object will check permissions against it
         self.get_addon_object(permission_classes=permission_classes)

src/olympia/amo/tests/__init__.py

@@ -363,7 +363,11 @@ def _credentials(self, value):
         pass
 
     def login_api(self, user):
-        self.api_key = self.create_api_key(user, str(user.pk) + ':f')
+        from olympia.api.models import APIKey
+
+        self.api_key = APIKey.objects.filter(user=user).first() or self.create_api_key(
+            user, str(user.pk) + ':f'
+        )
 
     def logout_api(self):
         self.api_key = None