Repository navigation
[ENG-12508] exclude preprints relationship for AVOL and return 403 on direct fetch - #11991
ihorsokhanexoft wants to merge 3 commits into
Conversation
adlius
left a comment
adlius
left a comment
There was a problem hiding this comment.
I think we can achieve the same functionality in a different existing way.
| return not isinstance(self.field, RelationshipField) | ||
|
|
||
|
|
||
| class HideIfViewOnlyLink(ConditionalField): |
There was a problem hiding this comment.
I think we had similar functionalities before. Could you check the non_anonymized_fields list defined in NodeSerializer and see if removing the preprint from that would work?
There was a problem hiding this comment.
@adlius we should remove preprints relationship only when AVOL is used. Removing preprints from non_anonymized_fields will remove property from response regardless of AVOL is used or not
adlius
left a comment
adlius
left a comment
There was a problem hiding this comment.
Two nit picks. LGTM otherwise.
| return self.preprints_queryset(node.preprints.all(), auth_user, latest_only=True) | ||
|
|
||
| def get_queryset(self): | ||
| if self.request.query_params.get('view_only'): |
There was a problem hiding this comment.
One more thing: can we use is_anonymized() to check the request here is instead of just looking at whether there is a URL query param?
| assert set(expected) == set(actual) | ||
|
|
||
| def test_view_only_link_cannot_fetch_node_preprints(self, app, project_one): | ||
| view_only_link = PrivateLinkFactory() |
There was a problem hiding this comment.
Should this be anonymous=True?
Ticket
https://openscience.atlassian.net/browse/ENG-12508
Purpose
User can access node preprints when uses AVOL
Changes
Hide
preprintsrelationship on node data fetch when AVOL is used.v2/nodes/<guid>/Raise 403 on
v2/nodes/<guid>/preprints/when AVOL is used