up

py/core/main/api/v3/documents_router.py

@@ -1270,7 +1270,10 @@ async def extract(
 
             settings = settings.dict() if settings else None  # type: ignore
             if not auth_user.is_superuser:
-                logger.warning("Implement permission checks here.")
+                raise R2RException(
+                    "Only a superuser can extract entities and relationships from a document.",
+                    403,
+                )
 
             # If no run type is provided, default to estimate
             if not run_type:
@@ -1376,6 +1379,15 @@ async def get_entities(
 
             Results are returned in the order they were extracted from the document.
             """
+            if (
+                not auth_user.is_superuser
+                and id not in auth_user.collection_ids
+            ):
+                raise R2RException(
+                    "The currently authenticated user does not have access to the specified collection.",
+                    403,
+                )
+
             # First check if the document exists and user has access
             documents_overview_response = await self.services[
                 "management"
@@ -1470,7 +1482,7 @@ async def get_entities(
             },
         )
         @self.base_endpoint
-        async def list_relationships(
+        async def get_relationships(
             id: UUID = Path(
                 ...,
                 description="The ID of the document to retrieve relationships for.",
@@ -1505,6 +1517,15 @@ async def list_relationships(
 
             Results are returned in the order they were extracted from the document.
             """
+            if (
+                not auth_user.is_superuser
+                and id not in auth_user.collection_ids
+            ):
+                raise R2RException(
+                    "The currently authenticated user does not have access to the specified collection.",
+                    403,
+                )
+
             # First check if the document exists and user has access
             documents_overview_response = await self.services[
                 "management"