def _sanitize_query(q):
 auth_project = acl.get_limited_to_project(pecan.request.headers)
 if auth_project:
  proj_q = [i for i in q if (i.field == 'project_id')]
  for i in proj_q:
   if ((auth_project != i.value) or (i.op != 'eq')):
    errstr = ('Not Authorized to access project %s %s' % (i.op, i.value))
    raise wsme.exc.ClientSideError(errstr)
  if (not proj_q):
   q.append(Query(field='project_id', op='eq', value=auth_project))
 return q

def _sanitize_query ( q ) : auth_project = acl . get_limited_to_project ( pecan . request . headers ) if auth_project : proj_q = [ i for i in q if ( i . field == 'project_id' ) ] for i in proj_q : if ( ( auth_project != i . value ) or ( i . op != 'eq' ) ) : errstr = ( 'Not Authorized to access project %s %s' % ( i . op , i . value ) ) raise wsme . exc . ClientSideError ( errstr ) if ( not proj_q ) : q . append ( Query ( field = 'project_id' , op = 'eq' , value = auth_project ) ) return q
check the query to see if: 1) the request is comming from admin - then allow full visibility 2) non-admin - make sure that the query includes the requesters project .