girder 5.0.21.dev2__tar.gz → 5.0.21.dev6__tar.gz

{girder-5.0.21.dev2/girder.egg-info → girder-5.0.21.dev6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: girder
-Version: 5.0.21.dev2
+Version: 5.0.21.dev6
 Summary: Web-based data management platform
 Home-page: https://girder.readthedocs.org
 Author: Kitware, Inc.

{girder-5.0.21.dev2 → girder-5.0.21.dev6}/girder/api/v1/item.py

@@ -1,3 +1,5 @@
+import cherrypy
+
 from girder.api import access
 from girder.constants import AccessType, SortDir, TokenScope
 from girder.exceptions import RestException
@@ -262,6 +264,8 @@ class Item(Resource):
     @access.public(scope=TokenScope.DATA_READ, cookie=True)
     @autoDescribeRoute(
         Description('Download the contents of an item.')
+        .notes('This endpoint also accepts the HTTP "Range" header for partial '
+               'downloads of single file items.')
         .modelParam('id', model=ItemModel, level=AccessType.READ)
         .param('offset', 'Byte offset into the file.', dataType='int',
                required=False, default=0)
@@ -289,8 +293,19 @@ class Item(Resource):
         if len(files) == 1 and format != 'zip':
             if contentDisposition not in {None, 'inline', 'attachment'}:
                 raise RestException('Unallowed contentDisposition type "%s".' % contentDisposition)
+            file = files[0]
+            endByte = None
+            rangeRequest = cherrypy.request.headers.get('Range')
+            if rangeRequest and file.get('size') is None:
+                # Ensure the file size is updated
+                File().updateSize(file)
+            rangeHeader = cherrypy.lib.httputil.get_ranges(rangeRequest, file.get('size', 0))
+            # The HTTP Range header takes precedence over the offset param
+            if rangeHeader and len(rangeHeader):
+                # Currently we only support a single range.
+                offset, endByte = rangeHeader[0]
             return File().download(
-                files[0], offset, contentDisposition=contentDisposition,
+                file, offset, endByte=endByte, contentDisposition=contentDisposition,
                 extraParameters=extraParameters)
         else:
             return self._downloadMultifileItem(item, user)

{girder-5.0.21.dev2 → girder-5.0.21.dev6}/girder/api/v1/resource.py

@@ -15,6 +15,13 @@ from ..rest import setContentDisposition, setResponseHeader
 # Plugins can modify this set to allow other types to be searched
 allowedSearchTypes = {'collection', 'file', 'folder', 'group', 'item', 'user'}
 allowedDeleteTypes = {'collection', 'file', 'folder', 'group', 'item', 'user'}
+# The access level and token scope needed to delete each type, matching the
+# type-specific delete endpoints.  Types not listed require admin access and
+# the DATA_OWN scope.
+_deleteTypeAccess = {
+    'file': (AccessType.WRITE, TokenScope.DATA_WRITE),
+    'item': (AccessType.WRITE, TokenScope.DATA_WRITE),
+}
 
 
 class Resource(BaseResource):
@@ -183,7 +190,7 @@ class Resource(BaseResource):
             yield zip.footer()
         return stream
 
-    @access.user(scope=TokenScope.DATA_OWN)
+    @access.user(scope=TokenScope.DATA_WRITE)
     @autoDescribeRoute(
         Description('Delete a set of items, folders, or other resources.')
         .jsonParam('resources', 'A JSON-encoded set of resources to delete. Each '
@@ -195,11 +202,14 @@ class Resource(BaseResource):
         .errorResponse('Invalid resources format.')
         .errorResponse('No resources specified.')
         .errorResponse('Resource not found.')
-        .errorResponse('Admin access was denied for a resource.', 403)
+        .errorResponse('Write or admin access was denied for a resource.', 403)
     )
     def delete(self, resources, progress):
         user = self.getCurrentUser()
         self._validateResourceSet(resources, allowedDeleteTypes)
+        for kind in resources:
+            self.ensureTokenScopes(_deleteTypeAccess.get(
+                kind, (AccessType.ADMIN, TokenScope.DATA_OWN))[1])
         total = sum([len(resources[key]) for key in resources])
         with ProgressContext(
                 progress, user=user, title='Deleting resources',
@@ -208,8 +218,9 @@ class Resource(BaseResource):
             current = 0
             for kind in resources:
                 model = self._getResourceModel(kind, 'remove')
+                level = _deleteTypeAccess.get(kind, (AccessType.ADMIN, TokenScope.DATA_OWN))[0]
                 for id in resources[kind]:
-                    doc = model.load(id=id, user=user, level=AccessType.ADMIN, exc=True)
+                    doc = model.load(id=id, user=user, level=level, exc=True)
 
                     # Don't do a subtree count if we weren't asked for progress
                     if progress:

{girder-5.0.21.dev2 → girder-5.0.21.dev6/girder.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: girder
-Version: 5.0.21.dev2
+Version: 5.0.21.dev6
 Summary: Web-based data management platform
 Home-page: https://girder.readthedocs.org
 Author: Kitware, Inc.

{girder-5.0.21.dev2 → girder-5.0.21.dev6}/girder.egg-info/scm_file_list.json

@@ -1065,6 +1065,7 @@
     "test/test_path_utilities.py",
     "test/test_plugin_registry.py",
     "test/test_position_endpoint.py",
+    "test/test_resource.py",
     "test/test_rest_exception_handling.py",
     "test/test_rest_utils.py",
     "test/test_settings.py",

{girder-5.0.21.dev2 → girder-5.0.21.dev6}/girder.egg-info/scm_version.json

@@ -1,7 +1,7 @@
 {
   "tag": "5.0.20",
-  "distance": 2,
-  "node": "ga6954f59751db96fe599cb58fbabeef6e558a9c1",
+  "distance": 6,
+  "node": "g4641b1d88450e86aedcc5b31380d0007cb054868",
   "dirty": false,
   "branch": "master",
   "node_date": "2026-10-26"