[BUGFIX] argilla-server: add authorize statement when creating reco…

…rds in bulk (#5201)

# Description
<!-- Please include a summary of the changes and the related issue.
Please also include relevant motivation and context. List any
dependencies that are required for this change. -->

This PR reverts the fix introduced in
#4959 by adding the
`authorize` statement when creating records in bulk

**Type of change**
<!-- Please delete options that are not relevant. Remember to title the
PR according to the type of change -->

- Bug fix (non-breaking change which fixes an issue)


**How Has This Been Tested**
<!-- Please add some reference about how your feature has been tested.
-->

**Checklist**
<!-- Please go over the list and make sure you've taken everything into
account -->

- I added relevant documentation
- I followed the style guidelines of this project
- I did a self-review of my code
- I made corresponding changes to the documentation
- I confirm My changes generate no new warnings
- I have added tests that prove my fix is effective or that my feature
works
- I have added relevant notes to the CHANGELOG.md file (See
https://keepachangelog.com/)

argilla-server/src/argilla_server/api/handlers/v1/datasets/records_bulk.py

@@ -56,6 +56,8 @@ async def create_dataset_records_bulk(
         ],
     )
 
+    await authorize(current_user, DatasetPolicy.create_records(dataset))
+
     records_bulk = await CreateRecordsBulk(db, search_engine).create_records_bulk(dataset, records_bulk_create)
 
     telemetry_client.track_data(action="DatasetRecordsCreated", data={"records": len(records_bulk.items)})

argilla-server/tests/unit/api/handlers/v1/datasets/records/records_bulk/test_dataset_records_bulk.py

@@ -15,6 +15,8 @@
 from uuid import UUID
 
 import pytest
+
+from argilla_server.constants import API_KEY_HEADER_NAME
 from argilla_server.enums import DatasetStatus
 from argilla_server.models import Dataset, Record
 from httpx import AsyncClient
@@ -26,6 +28,7 @@
     RecordFactory,
     TermsMetadataPropertyFactory,
     TextFieldFactory,
+    AnnotatorFactory,
 )
 
 
@@ -186,6 +189,19 @@ async def test_update_record_for_other_dataset(
         assert (await db.execute(select(func.count(Record.id)))).scalar_one() == 1
         assert (await db.execute(select(Record))).scalar_one().metadata_ is None
 
+    async def test_create_records_in_bulk_as_annotator(self, async_client: AsyncClient):
+        user = await AnnotatorFactory.create()
+
+        dataset = await self.test_dataset()
+
+        response = await async_client.post(
+            self.url(dataset.id),
+            headers={API_KEY_HEADER_NAME: user.api_key},
+            json={"items": [{"fields": {"text": "The text field"}}]},
+        )
+
+        assert response.status_code == 403, response.json()
+
     async def _configure_dataset_metadata_properties(self, dataset):
         await TermsMetadataPropertyFactory.create(name="terms_metadata", dataset=dataset)