Function get_server

web/pgadmin/utils/server_access.py:24–65

Fetch a server by ID, verifying the current user has access. Args: sid: Server ID. only_owned: If True, only return servers owned by the current user. Use this for write operations (change_password, clear_saved_password, etc.) that must not mutate another

(sid, only_owned=False)

def get_server(sid, only_owned=False):
    """Fetch a server by ID, verifying the current user has access.

    Args:
        sid: Server ID.
        only_owned: If True, only return servers owned by the current
            user. Use this for write operations (change_password,
            clear_saved_password, etc.) that must not mutate another
            user's server record via shared access.

    Returns the server if:
    - Desktop mode (single user, no isolation needed), OR
    - The user owns it, OR
    - The server is shared AND only_owned is False.

    Returns None otherwise (caller should return HTTP 410 Gone, in
    line with the rest of the server views — see e.g.
    web/pgadmin/browser/server_groups/servers/__init__.py).

    The Administrator role does not grant access to other users'
    private servers — admins are subject to the same data isolation
    as regular users. To make a server admin-visible, share it
    (Server.shared=True).

    Note: In pgAdmin, Server.shared=True means the server is visible
    to all authenticated users. SharedServer records are created
    lazily for per-user customization, not for access control.
    """
    if not config.SERVER_MODE:
        return Server.query.filter_by(id=sid).first()

    if only_owned:
        return Server.query.filter_by(
            id=sid, user_id=current_user.id).first()

    return Server.query.filter(
        Server.id == sid,
        or_(
            Server.user_id == current_user.id,
            Server.shared
        )
    ).first()


def get_server_group(gid):