Fix: only return search hits that are showable

1 files changed, 16 insertions, 1 deletions

diff --git a/muck_poc b/muck_poc
index 85278ea..edf59e7 100755
--- a/muck_poc
+++ b/muck_poc
@@ -153,11 +153,26 @@ class MuckAPI:
         return self._create_response(200, 'delete', meta, res)
 
     def _search_res(self, claims):
+        def is_showble(rid):
+            try:
+                meta, res = self._get_existing(rid)
+            except bottle.HTTPError as e:
+                return False
+            return self._access_is_allowed(meta, claims):
+
         body = self._get_json_body()
         cond = body.get('cond')
         ms = self._store.get_memory_store()
+
+        hits = ms.search(cond)
+        hits = [
+            rid
+            for rid in ms.search(cond)
+            if is_showable(rid)
+        ]
+
         result = {
-            'resources': ms.search(cond),
+            'resources': hits,
         }
         return bottle.HTTPResponse(status=200, body=json.dumps(result))