TST: test state is not being leaked when retrieve permissions is missing

tests/test_state.py

@@ -111,6 +111,7 @@ def setup_module():
             "ACL": None})
     state_acl = db.ACL()
     state_acl.grant(role="role1", permission="UPDATE:DESCRIPTION")
+    state_acl.deny(role="anonymous", permission="*")
     state_acl = db.State.create_state_acl(state_acl)
     st1.acl = state_acl.combine(st1.acl)
     st1.update_acl()
@@ -146,6 +147,8 @@ def setup_module():
 
 def teardown_function(function):
     switch_to_admin_user()
+    # deactivate anonymous user
+    db.administration.set_server_property("AUTH_OPTIONAL", "FALSE")
     d = db.execute_query("FIND TestRT")
     if len(d) > 0:
         d.delete(flags={"forceFinalState": "true"})
@@ -806,3 +809,28 @@ def test_transitions_included_after_empty_update():
                                               db.Transition(name="Transition4",
                                                             from_state="State2",
                                                             to_state="State2")}
+
+
+def test_missing_retrieve_permission():
+    """When the retrieve permission is missing, the state must not be leaked."""
+    rec = db.Record()
+    rec.description = "old description"
+    rec.add_parent("TestRT")
+    rec.state = db.State(model="Model1", name="State1")
+    rec.insert(flags={"ACL": None})
+    print(rec)
+
+    # switch to anonymous
+    db.administration.set_server_property("AUTH_OPTIONAL", "TRUE")
+    db.configure_connection(password_method="unauthenticated")
+    assert db.Info().user_info.roles == ["anonymous"]
+
+    rec2 = db.Record(id=rec.id)
+    with pytest.raises(db.TransactionError) as te:
+        rec2.retrieve()
+    assert te.value.has_error(db.AuthorizationError)
+
+    rec2 = db.Record(id=rec.id)
+    rec2.retrieve(raise_exception_on_error=False)
+    assert len(rec2.get_errors()) > 0
+    assert rec2.state is None