Return 404 if accessing unpublished dataset aka entity list #974
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
2 tasks
matthew-white
approved these changes
Sep 12, 2023
lib/resources/datasets.js
Outdated
| @@ -26,6 +27,7 @@ module.exports = (service, endpoint) => { | |||
| Datasets.get(params.projectId, params.name) | |||
| .then(getOrNotFound) | |||
| .then((dataset) => auth.canOrReject('dataset.read', dataset) | |||
| .then(rejectIf((() => dataset.publishedAt == null), noargs(Problem.user.notFound))) | |||
There was a problem hiding this comment.
Rather than adding a separate check, I think you could use the optional third parameter of Datasets.get(). That's how some other endpoints are returning a 404 (for example, lib/resources/entities.js).
ktuite
force-pushed
the
ktuite/no-access-unpublished-entity-list
branch
from
465c926
to
d0e2f8c
Compare
|
This issue was actually fixed by #934 and now this PR is just a new test :D |
2 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Backend part of getodk/central#467
What has been done to verify that this works as intended?
Tested it with frontend and added a specific test.
Why is this the best possible solution? Were any other approaches considered?
When getting metadata about a dataset/entity list, it doesn't even seem to include the
publishedAttimestamp, so it makes sense to only return published datasets at the/datasets/:nameurl and return 404 resource not found otherwise.How does this change affect users? Describe intentional changes to behavior and behavior that could have accidentally been affected by code changes. In other words, what are the regression risks?
Limits access to unpublished datasets but makes some parts of frontend more consistent.
Does this change require updates to the API documentation? If so, please update docs/api.md as part of this PR.
Writing this out in the API would be a good idea. Tagging #949
Before submitting this PR, please make sure you have:
make test-fulland confirmed all checks still pass OR confirm CircleCI build passes