Skip to content

Remove special permission access for annotate endpoint #558

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
maxachis merged 1 commit into from
Dec 17, 2025
Merged

Remove special permission access for annotate endpoint #558

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions src/api/endpoints/annotate/routes.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@
from src.core.core import AsyncCore
from src.db.queries.implementations.anonymous_session import MakeAnonymousSessionQueryBuilder
from src.security.dtos.access_info import AccessInfo
from src.security.manager import get_access_info
from src.security.manager import get_access_info, get_standard_user_access_info

annotate_router = APIRouter(
prefix="/annotate",
Expand Down Expand Up @@ -76,7 +76,7 @@ async def annotate_url_for_all_annotations_and_get_next_url_anonymous(

@annotate_router.get("/all")
async def get_next_url_for_all_annotations(
access_info: AccessInfo = Depends(get_access_info),
access_info: AccessInfo = Depends(get_standard_user_access_info),
async_core: AsyncCore = Depends(get_async_core),
batch_id: int | None = batch_query,
anno_url_id: int | None = url_id_query
Expand All @@ -92,7 +92,7 @@ async def annotate_url_for_all_annotations_and_get_next_url(
url_id: int,
all_annotation_post_info: AllAnnotationPostInfo,
async_core: AsyncCore = Depends(get_async_core),
access_info: AccessInfo = Depends(get_access_info),
access_info: AccessInfo = Depends(get_standard_user_access_info),
batch_id: int | None = batch_query,
anno_url_id: int | None = url_id_query
) -> GetNextURLForAllAnnotationResponse:
Expand Down
5 changes: 5 additions & 0 deletions src/security/manager.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,6 +69,11 @@
) -> AccessInfo:
return SecurityManager().check_access(token, Permissions.SOURCE_COLLECTOR)

def get_standard_user_access_info(

Check warning on line 72 in src/security/manager.py

View workflow job for this annotation

GitHub Actions / flake8

[flake8] src/security/manager.py#L72 <103> 

Missing docstring in public function
Raw output 
./src/security/manager.py:72:1: D103 Missing docstring in public function
token: Annotated[str, Depends(oauth2_scheme)]
) -> AccessInfo:
return SecurityManager().validate_token(token)

def require_permission(permission: Permissions):
def dependency(token: Annotated[str, Depends(oauth2_scheme)]) -> AccessInfo:
return SecurityManager().check_access(token, permission=permission)
Expand Down
3 changes: 2 additions & 1 deletion tests/automated/integration/conftest.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@
from src.db.models.impl.url.core.sqlalchemy import URL
from src.security.dtos.access_info import AccessInfo
from src.security.enums import Permissions
from src.security.manager import get_access_info
from src.security.manager import get_access_info, get_standard_user_access_info
from tests.automated.integration.api._helpers.RequestValidator import RequestValidator
from tests.helpers.api_test_helper import APITestHelper
from tests.helpers.data_creator.core import DBDataCreator
Expand Down Expand Up @@ -135,6 +135,7 @@ def override_access_info() -> AccessInfo:
def client(disable_task_flags) -> Generator[TestClient, None, None]:
with TestClient(app) as c:
app.dependency_overrides[get_access_info] = override_access_info
app.dependency_overrides[get_standard_user_access_info] = override_access_info
async_core: AsyncCore = c.app.state.async_core

# Interfaces to the web should be mocked
Expand Down