[ENG-12508] exclude preprints relationship for AVOL and return 403 on direct fetch

api/nodes/serializers.py

@@ -239,7 +239,6 @@ class NodeSerializer(TaxonomizableSerializerMixin, JSONAPISerializer):
         'node_links',
         'parent',
         'preprint',
-        'preprints',
         'public',
         'region',
         'registration',

api/nodes/views.py

@@ -5,6 +5,7 @@
 import dataclasses
 import waffle
 
+from api.base.serializers import is_anonymized
 from api.collections.serializers import CollectionSerializer
 from osf import features
 from packaging.version import Version
@@ -2280,6 +2281,8 @@ def get_default_queryset(self):
         return self.preprints_queryset(node.preprints.all(), auth_user, latest_only=True)
 
     def get_queryset(self):
+        if is_anonymized(self.request):
+            raise PermissionDenied
         return self.get_queryset_from_request()
 
 

api_tests/nodes/views/test_node_detail.py

@@ -572,6 +572,16 @@ def test_current_user_permissions_vol(self, app, user, url_public, project_publi
         res = app.get(f'{url_public}?view_only={private_link.key}', auth=user.auth)
         assert [permissions.READ] == res.json['data']['attributes']['current_user_permissions']
 
+    def test_preprints_relationship_hidden_for_view_only_link(self, app, url_public, project_public):
+        private_link = PrivateLinkFactory(anonymous=True)
+        private_link.nodes.add(project_public)
+        private_link.save()
+
+        response = app.get(f'{url_public}?view_only={private_link.key}')
+
+        assert response.status_code == 200
+        assert 'preprints' not in response.json['data']['relationships']
+
     def test_spammed_node_detail_gone(self, app, user, project_public, url_public):
         project_public.confirm_spam(save=True, train_spam_services=False)
         res = app.get(url_public, expect_errors=True)

api_tests/nodes/views/test_node_preprints.py

@@ -9,6 +9,7 @@
     AuthUserFactory,
     ProjectFactory,
     PreprintProviderFactory,
+    PrivateLinkFactory,
 )
 from osf.utils import permissions
 
@@ -104,6 +105,16 @@ def test_filter_withdrawn_preprint(self, app, url, user, project_one, provider_o
         actual = [preprint['id'] for preprint in res.json['data']]
         assert set(expected) == set(actual)
 
+    def test_view_only_link_cannot_fetch_node_preprints(self, app, project_one):
+        view_only_link = PrivateLinkFactory(anonymous=True)
+        view_only_link.nodes.add(project_one)
+        view_only_link.save()
+        url = f'/{API_BASE}nodes/{project_one._id}/preprints/?view_only={view_only_link.key}'
+
+        response = app.get(url, expect_errors=True)
+
+        assert response.status_code == 403
+
 
 class TestNodePreprintIsPublishedList(PreprintIsPublishedListMixin):