Pass request user to DataSetForm is_valid func

portal/forms.py

@@ -257,6 +257,8 @@ class BatchDeleteDataFileForm(forms.Form):
 
 
 class DataSetForm(forms.ModelForm):
+    request_profile = None
+
     class Meta:
         model = DataSet
         fields = ('name', 'share_profiles', 'share_labs', 'share_groups', 'files', 'read_only')
@@ -268,6 +270,20 @@ class DataSetForm(forms.ModelForm):
             'files': _('Files')
         }
 
+    def __init__(self, *args, **kwargs):
+        request_profile = kwargs.pop('request_profile', None)
+        if request_profile:
+            self.request_profile = request_profile
+        super().__init__(*args, **kwargs)
+
+    def is_valid(self) -> bool:
+        is_valid = super().is_valid()
+        if not is_valid:
+            return is_valid
+        elif self.instance.id: # Apply only to DS update
+            is_valid = self.instance in DataSet.objects.writable_by_profile(self.request_profile)
+        return is_valid
+
 
 class DataSetDisplayFieldsForm(forms.ModelForm):
     options = forms.MultipleChoiceField(

portal/graphql_schema.py

@@ -200,6 +200,7 @@ class DataSetMutation(DjangoModelFormMutation):
     @classmethod
     def get_form_kwargs(cls, root, info, **input) -> dict:
         kwargs = super().get_form_kwargs(root, info, **input)
+        kwargs['request_profile'] = info.context.user.profile
         if 'read_only' not in kwargs['data'] and 'instance' not in kwargs.keys():
             kwargs['data']['read_only'] = True
         return kwargs

portal/views/secure/dataset.py

@@ -138,6 +138,11 @@ class DataSetCreateView(LoginRequiredMixin, CreateViewMixin, CreateView):
     active_page = 'datasets'
     template_name = 'portal/secure/user/create_update.html'
 
+    def get_form_kwargs(self):
+        kwargs =  super().get_form_kwargs()
+        kwargs.update({'request_profile': self.request.user.profile})
+        return kwargs
+
     def get_form(self, form_class=None):
         form = super().get_form(form_class)
         form.fields['share_profiles'].queryset = Profile.objects.exclude_profile(self.request.user.profile)
@@ -165,6 +170,11 @@ class DataSetUpdateView(DataSetLogMixin, LoginRequiredMixin, UpdateViewMixin, Up
     active_page = 'datasets'
     template_name = 'portal/secure/user/create_update.html'
 
+    def get_form_kwargs(self):
+        kwargs =  super().get_form_kwargs()
+        kwargs.update({'request_profile': self.request.user.profile})
+        return kwargs
+
     def get_context_data(self, **kwargs):
         context = super().get_context_data(**kwargs)
         context['warning_msg'] = _('You are about to modify this DataSet. If you are not its original owner, please make sure that you have permission to perform this action.')