Do not set permissions on internal aliases.

modoboa/admin/api/v1/viewsets.py

@@ -192,6 +192,18 @@ class AccountViewSet(
         return Response(body)
 
 
+class AliasFilter(dj_filters.FilterSet):
+
+    domain = dj_filters.ModelChoiceFilter(
+        queryset=lambda request: models.Domain.objects.get_for_admin(request.user),
+        field_name="mailbox__domain",
+    )
+
+    class Meta:
+        model = models.Alias
+        fields = ["domain"]
+
+
 class AliasViewSet(
     GetThrottleViewsetMixin, lib_viewsets.RevisionModelMixin, viewsets.ModelViewSet
 ):
@@ -200,6 +212,10 @@ class AliasViewSet(
     Create a new alias instance.
     """
 
+    filter_backends = [
+        dj_filters.DjangoFilterBackend,
+    ]
+    filterset_class = AliasFilter
     permission_classes = [
         IsAuthenticated,
         DjangoModelPermissions,
@@ -209,14 +225,12 @@ class AliasViewSet(
     def get_queryset(self):
         """Filter queryset based on current user."""
         user = self.request.user
+        if user is None or user.is_anonymous:
+            return models.Alias.objects.none()
         ids = user.objectaccess_set.filter(
             content_type=ContentType.objects.get_for_model(models.Alias)
         ).values_list("object_id", flat=True)
-        queryset = models.Alias.objects.filter(pk__in=ids)
-        domain = self.request.query_params.get("domain")
-        if domain:
-            queryset = queryset.filter(domain__name=domain)
-        return queryset
+        return models.Alias.objects.filter(pk__in=ids, internal=False)
 
 
 class SenderAddressFilterSet(dj_filters.FilterSet):

modoboa/admin/api/v2/serializers.py

@@ -521,7 +521,8 @@ class WritableAccountSerializer(v1_serializers.WritableAccountSerializer):
         if not param_tools.get_global_parameter("enable_admin_limits", app="limits"):
             return
         del self.fields["domains"]
-        if self.context["request"].user.role in ["Resellers", "SuperAdmins"]:
+        user = self.context["request"].user
+        if not user.is_anonymous and user.role in ["Resellers", "SuperAdmins"]:
             self.fields["resources"] = WritableResourceSerializer(
                 many=True, required=False
             )

modoboa/admin/api/v2/viewsets.py

@@ -74,7 +74,9 @@ class DomainViewSet(
 
     def get_queryset(self):
         """Filter queryset based on current user."""
-        return models.Domain.objects.get_for_admin(self.request.user)
+        if self.request.user and not self.request.user.is_anonymous:
+            return models.Domain.objects.get_for_admin(self.request.user)
+        return models.Domain.objects.none()
 
     def get_serializer_class(self, *args, **kwargs):
         if self.action == "delete":
@@ -198,6 +200,8 @@ class AccountViewSet(v1_viewsets.AccountViewSet):
     def get_queryset(self):
         """Filter queryset based on current user."""
         user = self.request.user
+        if not user or user.is_anonymous:
+            return core_models.User.objects.none()
         ids = user.objectaccess_set.filter(
             content_type=ContentType.objects.get_for_model(user)
         ).values_list("object_id", flat=True)
@@ -271,14 +275,27 @@ class IdentityViewSet(GetThrottleViewsetMixin, viewsets.ViewSet):
         return response.Response({"status": status, "message": msg})
 
 
+class AliasFilter(dj_filters.FilterSet):
+
+    domain = dj_filters.ModelChoiceFilter(
+        queryset=lambda request: models.Domain.objects.get_for_admin(request.user),
+        field_name="domain__name",
+    )
+
+    class Meta:
+        model = models.Alias
+        fields = ["domain"]
+
+
 class AliasViewSet(v1_viewsets.AliasViewSet):
     """Viewset for Alias."""
 
-    filter_backends = (
+    filter_backends = [
+        dj_filters.DjangoFilterBackend,
         filters.OrderingFilter,
         filters.SearchFilter,
-        dj_filters.DjangoFilterBackend,
-    )
+    ]
+    filterset_class = AliasFilter
     pagination_class = pagination.CustomPageNumberPagination
     search_fields = ["address"]
     serializer_class = serializers.AliasSerializer
@@ -391,6 +408,8 @@ class AlarmViewSet(
     serializer_class = serializers.AlarmSerializer
 
     def get_queryset(self):
+        if self.request.user.is_anonymous:
+            return models.Alarm.objects.none()
         return (
             models.Alarm.objects.select_related("domain")
             .filter(domain__in=models.Domain.objects.get_for_admin(self.request.user))