Skip to content

Bugfix/allow reading groups anonymous user #1615

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Jul 8, 2020
Merged

Bugfix/allow reading groups anonymous user #1615

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
a3bd3f5
add groups.read secutiry role
sanderegg Jul 8, 2020
f339fd3
test that groups right are correctly setup
sanderegg Jul 8, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions services/web/server/src/simcore_service_webserver/groups_handlers.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@

# groups/ ------------------------------------------------------
@login_required
@permission_required("groups.*")
@permission_required("groups.read")
async def list_groups(request: web.Request):
user_id = request[RQT_USERID_KEY]
primary_group, user_groups, all_group = await groups_api.list_user_groups(
Expand All @@ -30,7 +30,7 @@ async def list_groups(request: web.Request):


@login_required
@permission_required("groups.*")
@permission_required("groups.read")
async def get_group(request: web.Request):
user_id = request[RQT_USERID_KEY]
gid = request.match_info["gid"]
Expand Down
1 change: 1 addition & 0 deletions services/web/server/src/simcore_service_webserver/security_roles.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,7 @@
"project.update",
"storage.locations.*", # "storage.datcore.read"
"storage.files.*",
"groups.read",
"project.open",
"project.read", # "studies.user.read",
# "studies.templates.read"
Expand Down
22 changes: 16 additions & 6 deletions services/web/server/tests/unit/with_dbs/test_groups.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -119,7 +119,9 @@ async def test_list_groups(
assert str(url) == f"{PREFIX}"

resp = await client.get(url)
data, error = await assert_status(resp, expected.ok)
data, error = await assert_status(
resp, expected.ok if user_role != UserRole.GUEST else web.HTTPOk
)

if not error:
assert isinstance(data, dict)
Expand Down Expand Up @@ -198,16 +200,20 @@ async def test_group_creation_workflow(client, logged_user, user_role, expected)
assert str(url) == f"{PREFIX}"

resp = await client.get(url)
data, error = await assert_status(resp, expected.ok)
if not error:
data, error = await assert_status(
resp, expected.ok if user_role != UserRole.GUEST else web.HTTPOk
)
if not error and user_role != UserRole.GUEST:
assert len(data["organizations"]) == 1
assert data["organizations"][0] == assigned_group

# check getting one group
url = client.app.router["get_group"].url_for(gid=str(assigned_group["gid"]))
assert str(url) == f"{PREFIX}/{assigned_group['gid']}"
resp = await client.get(url)
data, error = await assert_status(resp, expected.ok)
data, error = await assert_status(
resp, expected.ok if user_role != UserRole.GUEST else web.HTTPNotFound
)
if not error:
assert data == assigned_group

Expand All @@ -226,7 +232,9 @@ async def test_group_creation_workflow(client, logged_user, user_role, expected)
url = client.app.router["get_group"].url_for(gid=str(assigned_group["gid"]))
assert str(url) == f"{PREFIX}/{assigned_group['gid']}"
resp = await client.get(url)
data, error = await assert_status(resp, expected.ok)
data, error = await assert_status(
resp, expected.ok if user_role != UserRole.GUEST else web.HTTPNotFound
)
if not error:
_assert_group(data)
assert data == assigned_group
Expand All @@ -249,7 +257,9 @@ async def test_group_creation_workflow(client, logged_user, user_role, expected)
url = client.app.router["get_group"].url_for(gid=str(assigned_group["gid"]))
assert str(url) == f"{PREFIX}/{assigned_group['gid']}"
resp = await client.get(url)
data, error = await assert_status(resp, expected.not_found)
data, error = await assert_status(
resp, expected.not_found if user_role != UserRole.GUEST else web.HTTPNotFound
)


@pytest.mark.parametrize(*standard_role_response())
Expand Down