allow read permissions for non-public contributors

CenterForOpenScience · Jul 29, 2024 · 7362ce5 · 7362ce5
1 parent fc1d301
commit 7362ce5
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 2 deletions.
diff --git a/api/base/permissions.py b/api/base/permissions.py
@@ -170,6 +170,6 @@ def has_object_permission(self, request, view, obj):
         resource = obj['self']
 
         if request.method in permissions.SAFE_METHODS:
-            return resource.is_public or resource.can_view(auth)
+            return resource.is_public or resource.has_permission(auth.user, 'read') or resource.can_view(auth)
         else:
             return resource.can_edit(auth)
diff --git a/osf/models/preprint.py b/osf/models/preprint.py
@@ -893,7 +893,9 @@ def can_edit(self, auth=None, user=None):
             raise ValueError('Cannot pass both `auth` and `user`')
         user = user or auth.user
 
-        return user and self.has_permission(user, WRITE)
+        return (
+            user and ((self.has_permission(user, WRITE) and self.has_submitted_preprint) or self.has_permission(user, ADMIN))
+        )
 
     def get_contributor_order(self):
         # Method needed for ContributorMixin