views: add permission check for creating a new deposit

Samk13 · Apr 11, 2024 · c2e950c · c2e950c
1 parent 5968c6c
commit c2e950c
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/invenio_app_rdm/records_ui/views/deposits.py b/invenio_app_rdm/records_ui/views/deposits.py
@@ -371,6 +371,12 @@ def new_record():
 @pass_draft_community
 def deposit_create(community=None):
     """Create a new deposit."""
+    can_create = current_rdm_records.records_service.check_permission(
+        g.identity, "create"
+    )
+    if not can_create:
+        raise PermissionDeniedError()
+
     community_theme = None
     if community is not None:
         community_theme = community.get("theme", {})