psat-server-web 0.4.2__tar.gz → 0.5.1__tar.gz

psat_server_web-0.5.1/PKG-INFO

@@ -0,0 +1,131 @@
+Metadata-Version: 2.1
+Name: psat-server-web
+Version: 0.5.1
+Summary: Pan-STARRS and ATLAS web interface.
+Home-page: https://github.com/genghisken/psat-server-web
+Author: genghisken
+Author-email: ken.w.smith@gmail.com
+License: MIT
+Classifier: Development Status :: 4 - Beta
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3.6
+Classifier: Topic :: Utilities
+Requires-Python: >=3.6
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: numpy
+Requires-Dist: mysqlclient
+Requires-Dist: django<4.2
+Requires-Dist: django_tables2
+Requires-Dist: djangorestframework
+Requires-Dist: mod-wsgi
+Requires-Dist: pyyaml
+Requires-Dist: docopt
+Requires-Dist: python-dotenv
+Requires-Dist: gkhtm
+Requires-Dist: gkutils>=0.3.2
+Requires-Dist: requests
+Requires-Dist: lasair
+Requires-Dist: dustmaps
+
+# psat-server-web
+Python 3 web interface for the Pan-STARRS and ATLAS surveys.
+
+To install:
+
+pip install psat-server-web
+
+Once installed, don't forget to add the "data" symlinks in the:
+
+site-packages/psat\_server\_web/atlas/media/images
+site-packages/psat\_server\_web/ps1/media/images
+
+directories which point to the location of the image stamps.
+
+--- 
+
+# Local development version 
+
+A localised development instance can be run with docker compose. You will need a 
+`.env` file in your repository root to define some environment variables, 
+looking something like:
+
+``` .env
+# Django settings
+SECRET_KEY={YOUR_SECRET_KEY_HERE}
+DJANGO_ALLOWED_HOSTS=localhost 127.0.0.1 [::1]
+
+# MySQL/MariaDB settings
+MYSQL_ROOT_USER=root
+MYSQL_ROOT_PASSWORD=root
+MYSQL_DATABASE=atlas
+MYSQL_USER=atlas
+MYSQL_PASSWORD=atlas
+MYSQL_PORT=3306
+MYSQL_TEST_DATABASE=atlas_test
+MYSQL_TEST_PORT=3306
+MYSQL_TEST_USER=root
+MYSQL_TEST_PASSWORD=root
+
+DJANGO_MYSQL_DBUSER=atlas
+DJANGO_LASAIR_TOKEN=
+
+```
+
+Several of the values are omitted but aren't necessary to run a development 
+environment. Also ruch simple passwords should not be used in production, but this should get you something running locally. Hopefully it's then as simple as running the following:
+
+``` bash
+docker compose up
+```
+
+Which will start 4 services, comprised of:
+- `db` - A MariaDB instance. By default served at `localhost:3036` 
+- `atlas-web` - A mod-wsgi instance to serve the django front end. By default 
+served at `localhost:8086` and requires `db` to be running.
+- `adminer` - A web interface for interacting with the db. By default served 
+at `localhost:8080` and requires `db` to be running.
+- `tests` - A single-use run of the unit tests using django's `manage.py test`. 
+Requires `db` to be running.
+
+Each of these services can be run independently with 
+
+``` bash
+docker compose up {service_name}
+```
+
+So if, for example, you wanted to run the tests you could execute 
+`docker compose up tests` and it would – after starting `db` if it is not 
+already running – perform a single run of the unit tests. 
+
+## A dummy database
+
+There are a few things you will likely need to do to get a fully working version 
+of the web-server so as to make your local version useful, namely: 
+1. Get a dummy database dump .sql file from one of the developers and place it into `data/init.sql`
+2. [Optional] Get an image dump and place it into `data/db_data/`
+3. Fix a mild issue with the database model (see next section)
+
+If you are having problems with any of this, contact one of the developers.
+
+### Issue with `TcsGravityEventAnnotations.map_iteration`
+
+If you are getting an error along the lines of 
+
+```
+atlas-web-1  | ERRORS:
+atlas-web-1  | atlas.TcsGravityEventAnnotations.map_iteration: (fields.E311) 'TcsGravityAlerts.map_iteration' must be unique because it is referenced by a foreign key.
+atlas-web-1  | 	HINT: Add unique=True to this field or add a UniqueConstraint (without condition) in the model Meta.constraints.
+```
+
+Then you may need to make an adjustment to the models, specifically by 
+uncommenting the line declaring `TcsGravityAlerts.map_iteration` which adds a 
+unique `kwarg`, and commenting the line without the unique `kwarg`, should solve 
+the problem. Specifically, the lines should look like 
+```
+# map_iteration = models.CharField(max_length=100, blank=True, null=True)
+map_iteration = models.CharField(max_length=100, blank=True, null=True, unique=True)
+``` 
+This is within the `TcsGravityAlerts(models.Model)` class. Again, please speak 
+to one of the developers if this is unclear. 
+

psat_server_web-0.5.1/README.md

@@ -0,0 +1,101 @@
+# psat-server-web
+Python 3 web interface for the Pan-STARRS and ATLAS surveys.
+
+To install:
+
+pip install psat-server-web
+
+Once installed, don't forget to add the "data" symlinks in the:
+
+site-packages/psat\_server\_web/atlas/media/images
+site-packages/psat\_server\_web/ps1/media/images
+
+directories which point to the location of the image stamps.
+
+--- 
+
+# Local development version 
+
+A localised development instance can be run with docker compose. You will need a 
+`.env` file in your repository root to define some environment variables, 
+looking something like:
+
+``` .env
+# Django settings
+SECRET_KEY={YOUR_SECRET_KEY_HERE}
+DJANGO_ALLOWED_HOSTS=localhost 127.0.0.1 [::1]
+
+# MySQL/MariaDB settings
+MYSQL_ROOT_USER=root
+MYSQL_ROOT_PASSWORD=root
+MYSQL_DATABASE=atlas
+MYSQL_USER=atlas
+MYSQL_PASSWORD=atlas
+MYSQL_PORT=3306
+MYSQL_TEST_DATABASE=atlas_test
+MYSQL_TEST_PORT=3306
+MYSQL_TEST_USER=root
+MYSQL_TEST_PASSWORD=root
+
+DJANGO_MYSQL_DBUSER=atlas
+DJANGO_LASAIR_TOKEN=
+
+```
+
+Several of the values are omitted but aren't necessary to run a development 
+environment. Also ruch simple passwords should not be used in production, but this should get you something running locally. Hopefully it's then as simple as running the following:
+
+``` bash
+docker compose up
+```
+
+Which will start 4 services, comprised of:
+- `db` - A MariaDB instance. By default served at `localhost:3036` 
+- `atlas-web` - A mod-wsgi instance to serve the django front end. By default 
+served at `localhost:8086` and requires `db` to be running.
+- `adminer` - A web interface for interacting with the db. By default served 
+at `localhost:8080` and requires `db` to be running.
+- `tests` - A single-use run of the unit tests using django's `manage.py test`. 
+Requires `db` to be running.
+
+Each of these services can be run independently with 
+
+``` bash
+docker compose up {service_name}
+```
+
+So if, for example, you wanted to run the tests you could execute 
+`docker compose up tests` and it would – after starting `db` if it is not 
+already running – perform a single run of the unit tests. 
+
+## A dummy database
+
+There are a few things you will likely need to do to get a fully working version 
+of the web-server so as to make your local version useful, namely: 
+1. Get a dummy database dump .sql file from one of the developers and place it into `data/init.sql`
+2. [Optional] Get an image dump and place it into `data/db_data/`
+3. Fix a mild issue with the database model (see next section)
+
+If you are having problems with any of this, contact one of the developers.
+
+### Issue with `TcsGravityEventAnnotations.map_iteration`
+
+If you are getting an error along the lines of 
+
+```
+atlas-web-1  | ERRORS:
+atlas-web-1  | atlas.TcsGravityEventAnnotations.map_iteration: (fields.E311) 'TcsGravityAlerts.map_iteration' must be unique because it is referenced by a foreign key.
+atlas-web-1  | 	HINT: Add unique=True to this field or add a UniqueConstraint (without condition) in the model Meta.constraints.
+```
+
+Then you may need to make an adjustment to the models, specifically by 
+uncommenting the line declaring `TcsGravityAlerts.map_iteration` which adds a 
+unique `kwarg`, and commenting the line without the unique `kwarg`, should solve 
+the problem. Specifically, the lines should look like 
+```
+# map_iteration = models.CharField(max_length=100, blank=True, null=True)
+map_iteration = models.CharField(max_length=100, blank=True, null=True, unique=True)
+``` 
+This is within the `TcsGravityAlerts(models.Model)` class. Again, please speak 
+to one of the developers if this is unclear. 
+

psat_server_web-0.5.1/psat_server_web/__version__.py

@@ -0,0 +1 @@
+__version__ = '0.5.1'

psat_server_web-0.5.1/psat_server_web/atlas/accounts/admin.py

@@ -0,0 +1,34 @@
+"""
+Customise admin interface for Group model to include GroupProfile, so default 
+expiry time for tokens can be set. 
+"""
+import logging
+
+from django.contrib import admin
+from django.contrib.auth.models import Group
+from django.forms.models import ModelForm
+from .models import GroupProfile
+
+
+logger = logging.getLogger(__name__)
+
+class AlwaysChangedModelForm(ModelForm):
+    def has_changed(self):
+        """ Should return True if data differs from initial. 
+        By always returning true even unchanged inlines will get validated and saved.
+        We need this because the GroupProfile needs to be created even if the default 
+        values haven't been changed. 
+        """
+        return True
+
+class GroupProfileInline(admin.StackedInline):
+    model = GroupProfile
+    can_delete = False
+    extra = 1
+    form = AlwaysChangedModelForm
+
+class GroupAdmin(admin.ModelAdmin):
+    inlines = (GroupProfileInline,)
+
+admin.site.unregister(Group)
+admin.site.register(Group, GroupAdmin)

psat_server_web-0.5.1/psat_server_web/atlas/accounts/migrations/0002_groupprofile_api_write_access.py

@@ -0,0 +1,18 @@
+# Generated by Django 5.1 on 2024-12-04 12:00
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('accounts', '0001_initial'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='groupprofile',
+            name='api_write_access',
+            field=models.BooleanField(default=False, help_text='Does the group have write access to the API?'),
+        ),
+    ]

{psat_server_web-0.4.2 → psat_server_web-0.5.1}/psat_server_web/atlas/accounts/models.py

@@ -17,10 +17,14 @@ class GroupProfile(models.Model):
         on_delete=models.CASCADE, 
         related_name='profile'
     )
+    api_write_access = models.BooleanField(
+        default=False,
+        help_text='Does the group have write access to the API?'
+    )
     token_expiration_time = models.DurationField(
         help_text='in days, default 1 day (24*60*60 seconds)',
         default=timedelta(days=1)
-        )
+    )
     description = models.TextField(
         blank=True,
         help_text='What is the group for?'

psat_server_web-0.5.1/psat_server_web/atlas/accounts/signals.py

@@ -0,0 +1,27 @@
+import logging
+
+from django.db.models import signals 
+from django.dispatch import receiver
+from django.contrib.auth.models import Group
+
+logger = logging.getLogger(__name__)
+
+@receiver(signals.post_save, sender=Group)
+def create_group_profile(sender, instance, created, **kwargs):
+    # NOTE (2024-11-12 JL): This function is no longer needed as we have instead 
+    # solved the problem of duplicate GroupProfile creation by using the 
+    # AlwaysChangedModelForm in the admin interface, but I'm leaving this here 
+    # as a reference for future use of signals and logging.
+    logger.debug('create_group_profile called')
+    logger.debug('instance: %s', instance)
+    logger.debug('created: %s', created)
+    
+    # Disconnect the signal so we don't get into a loop
+    signals.post_save.disconnect(create_group_profile, sender=Group)
+    
+    if created:
+        logger.debug('In created block')
+        
+    # Reconnect the signal once we're done
+    signals.post_save.connect(create_group_profile, sender=Group)
+    logger.debug('create_group_profile finished')

{psat_server_web-0.4.2 → psat_server_web-0.5.1}/psat_server_web/atlas/atlas/settings.py

@@ -25,9 +25,9 @@ SITE_ID = 1
 SECRET_KEY = os.environ.get('DJANGO_SECRET_KEY')
 
 # SECURITY WARNING: don't run with debug turned on in production!
-DEBUG = True
+DEBUG = os.environ.get('DJANGO_DEBUG', 'False') == 'True'
 
-TEMPLATE_DEBUG = True
+TEMPLATE_DEBUG = os.environ.get('DJANGO_DEBUG', 'False') == 'True'
 
 # 2021-08-21 KWS Need to set this to None, otherwise default is 1000.
 DATA_UPLOAD_MAX_NUMBER_FIELDS = None
@@ -57,14 +57,17 @@ LOGOUT_URL = 'logout'
 
 DATABASES = {
     'default': {
-        'ENGINE': 'django.db.backends.mysql',
+        'ENGINE': os.environ.get('DJANGO_DB_ENGINE', 'django.db.backends.mysql'),
         'NAME': os.environ.get('DJANGO_MYSQL_DBNAME'),
         'USER': os.environ.get('DJANGO_MYSQL_DBUSER'),
         'PASSWORD': os.environ.get('DJANGO_MYSQL_DBPASS'),
         'HOST': os.environ.get('DJANGO_MYSQL_DBHOST'),
         'PORT': int(os.environ.get('DJANGO_MYSQL_DBPORT')),
         'TEST': {
-            'NAME': os.environ.get('DJANGO_MYSQL_TESTDBNAME'),
+            'NAME': os.environ.get('DJANGO_MYSQL_TEST_DBNAME'),
+            'PORT': os.environ.get('DJANGO_MYSQL_TEST_DBPORT'),
+            'USER': os.environ.get('DJANGO_MYSQL_TEST_DBUSER'),
+            'PASSWORD': os.environ.get('DJANGO_MYSQL_TEST_DBPASS'),
         }
     }
 }
@@ -84,6 +87,49 @@ DAEMONS = {
 }
 
 
+DJANGO_LOG_LEVEL = os.environ.get('DJANGO_LOG_LEVEL', 'WARNING')
+LOGGING = {
+    "version": 1,  # the dictConfig format version
+    "disable_existing_loggers": False,  # retain the default loggers
+    "formatters": {
+        "verbose": {
+            "format": "{name} {levelname} {asctime} {module} {message}",
+            "style": "{",
+        },
+        "simple": {
+            "format": "{levelname} {message}",
+            "style": "{",
+        },
+    },
+
+    "handlers": {
+        # The different log handlers are defined here. We have a file logger and 
+        # a stderr logger - which reroutes to the error_log file managed by wsgi.  
+        "file": {
+            "class": "logging.FileHandler",
+            "filename": "django-default.log",
+            "level": DJANGO_LOG_LEVEL,
+            "formatter": "verbose",
+        },
+        "stderr": {
+            "class": "logging.StreamHandler",
+            "level": DJANGO_LOG_LEVEL,
+            "formatter": "verbose",
+            "stream": "ext://sys.stderr",
+        }
+    },
+    # Implement the stderr logger as the default logger.
+    "loggers": {
+        "": {
+            "handlers": ["stderr"],
+            "level": DJANGO_LOG_LEVEL,
+            "propagate": True,
+        },
+    }
+
+}
+
+
 LANGUAGE_CODE = 'en-gb'
 
 TIME_ZONE = 'UTC'
@@ -187,4 +233,4 @@ INSTALLED_APPS = [
 ]
 
 # Token expiry time in days, default 1 day (24*60*60 seconds)
-TOKEN_EXPIRY = int(os.environ.get("API_TOKEN_EXPIRY") or 86400) # seconds
+TOKEN_EXPIRY = int(os.environ.get("API_TOKEN_EXPIRY") or 86400) # seconds

{psat_server_web-0.4.2 → psat_server_web-0.5.1}/psat_server_web/atlas/atlasapi/authentication.py

@@ -1,4 +1,5 @@
 from re import match
+import logging
 
 from django.conf import settings
 from django.utils.timezone import now
@@ -6,6 +7,8 @@ from rest_framework.authtoken.models import Token
 from rest_framework.authentication import TokenAuthentication
 from rest_framework.exceptions import AuthenticationFailed
 
+logger = logging.getLogger(__name__)
+
 class ExpiringTokenAuthentication(TokenAuthentication):
     """
     Token authentication using the ExpiringToken model, which has an expiry 
@@ -23,8 +26,9 @@ class ExpiringTokenAuthentication(TokenAuthentication):
             try:
                 group_profile = user.groups.first().profile
             except AttributeError:
-                # TODO: Log this error?
-                raise AuthenticationFailed('Could not authenticate: Group has no profile. Please contact administrator.')
+                msg = 'Could not authenticate: Group has no profile. Please contact administrator.'
+                logger.error(msg)
+                raise AuthenticationFailed(msg)
             token_expiration_time = group_profile.token_expiration_time.total_seconds()
         else:
             # Otherwise use the default expiration time
@@ -33,6 +37,7 @@ class ExpiringTokenAuthentication(TokenAuthentication):
         # Calculate the token's age and compare it to the expiration setting
         token_age = (now() - token.created).total_seconds()
         if token_age > token_expiration_time:
+            logger.warning(f'User {user} attempted to use an expired token.')
             raise AuthenticationFailed('Token has expired.')
         
         return user, token

psat_server_web-0.5.1/psat_server_web/atlas/atlasapi/permissions.py

@@ -0,0 +1,45 @@
+import logging
+
+from rest_framework.permissions import BasePermission, SAFE_METHODS
+
+
+logger = logging.getLogger(__name__)
+
+class HasReadAccess(BasePermission):
+    def has_permission(self, request, view):
+        # Allow all safe methods (GET, OPTIONS, HEAD)
+        if request.method in SAFE_METHODS:
+            return True
+
+        # Allow POST if the user is authenticated
+        return (request.user 
+                and request.user.is_authenticated)
+
+
+class HasWriteAccess(BasePermission):
+    def has_permission(self, request, view):
+        # Allow all safe methods (GET, OPTIONS, HEAD)
+        if request.method in SAFE_METHODS:
+            return True
+        
+        write_fl = False
+        user = request.user
+        # Retrieve the user's group and get the api write access flag from the 
+        # group profile
+        if user.groups.exists():
+            try:
+                group_profile = user.groups.first().profile
+                write_fl = group_profile.api_write_access
+            except AttributeError:
+                # If the group has no profile, then there's something wrong with 
+                # the database. This should be fixed by an administrator, but 
+                # we don't need to block the user from accessing the API.
+                msg = 'Could not authorise based on group: Group has no profile.'
+                logger.error(msg)
+                write_fl = False
+        
+        # Only allow POST to write endpoints if the user is authenticated and is
+        # either in a writeable group or is a staff member
+        return (request.user 
+                and request.user.is_authenticated 
+                and (write_fl or request.user.is_staff))

{psat_server_web-0.4.2 → psat_server_web-0.5.1}/psat_server_web/atlas/atlasapi/views.py

@@ -28,7 +28,7 @@ from .serializers import (
     ObjectDetectionListSerializer,
 )
 from .authentication import QueryAuthentication, ExpiringTokenAuthentication
-from .permissions import IsApprovedUser
+from .permissions import HasReadAccess, HasWriteAccess
 
 def retcode(message):
     if 'error' in message: return status.HTTP_400_BAD_REQUEST
@@ -68,7 +68,7 @@ class ObtainExpiringAuthToken(ObtainAuthToken):
 
 class ConeView(APIView):
     authentication_classes = [ExpiringTokenAuthentication, QueryAuthentication]
-    permission_classes = [IsAuthenticated&IsApprovedUser]
+    permission_classes = [IsAuthenticated&HasReadAccess]
 
     def get(self, request):
         serializer = ConeSerializer(data=request.GET, context={'request': request})
@@ -87,7 +87,7 @@ class ConeView(APIView):
 
 class ObjectsView(APIView):
     authentication_classes = [ExpiringTokenAuthentication, QueryAuthentication]
-    permission_classes = [IsAuthenticated&IsApprovedUser]
+    permission_classes = [IsAuthenticated&HasReadAccess]
 
     def get(self, request):
         serializer = ObjectsSerializer(data=request.GET, context={'request': request})
@@ -106,7 +106,7 @@ class ObjectsView(APIView):
 
 class ObjectListView(APIView):
     authentication_classes = [ExpiringTokenAuthentication, QueryAuthentication]
-    permission_classes = [IsAuthenticated&IsApprovedUser]
+    permission_classes = [IsAuthenticated&HasReadAccess]
 
     def get(self, request):
         serializer = ObjectListSerializer(data=request.GET, context={'request': request})
@@ -125,7 +125,7 @@ class ObjectListView(APIView):
 
 class VRAScoresView(APIView):
     authentication_classes = [ExpiringTokenAuthentication, QueryAuthentication]
-    permission_classes = [IsAuthenticated&IsApprovedUser]
+    permission_classes = [IsAuthenticated&HasWriteAccess]
 
     def get(self, request):
         return Response({"Error": "GET is not implemented for this service."})
@@ -142,7 +142,7 @@ class VRAScoresView(APIView):
 
 class VRAScoresListView(APIView):
     authentication_classes = [ExpiringTokenAuthentication, QueryAuthentication]
-    permission_classes = [IsAuthenticated&IsApprovedUser]
+    permission_classes = [IsAuthenticated&HasReadAccess]
 
     def get(self, request):
         serializer = VRAScoresListSerializer(data=request.GET, context={'request': request})
@@ -162,7 +162,7 @@ class VRAScoresListView(APIView):
 #                appropriate to the circumstances. E.g. if object is not found generate a 404, etc.
 class VRATodoView(APIView):
     authentication_classes = [ExpiringTokenAuthentication, QueryAuthentication]
-    permission_classes = [IsAuthenticated&IsApprovedUser]
+    permission_classes = [IsAuthenticated&HasWriteAccess]
 
     def get(self, request):
         return Response({"Error": "GET is not implemented for this service."})
@@ -179,7 +179,7 @@ class VRATodoView(APIView):
 # 2024-05-07 KWS Added VRATodoListView.
 class VRATodoListView(APIView):
     authentication_classes = [ExpiringTokenAuthentication, QueryAuthentication]
-    permission_classes = [IsAuthenticated&IsApprovedUser]
+    permission_classes = [IsAuthenticated&HasReadAccess]
 
     def get(self, request):
         serializer = VRATodoListSerializer(data=request.GET, context={'request': request})
@@ -197,7 +197,7 @@ class VRATodoListView(APIView):
 
 class TcsObjectGroupsView(APIView):
     authentication_classes = [ExpiringTokenAuthentication, QueryAuthentication]
-    permission_classes = [IsAuthenticated&IsApprovedUser]
+    permission_classes = [IsAuthenticated&HasWriteAccess]
 
     def get(self, request):
         return Response({"Error": "GET is not implemented for this service."})
@@ -213,7 +213,7 @@ class TcsObjectGroupsView(APIView):
 
 class TcsObjectGroupsListView(APIView):
     authentication_classes = [ExpiringTokenAuthentication, QueryAuthentication]
-    permission_classes = [IsAuthenticated&IsApprovedUser]
+    permission_classes = [IsAuthenticated&HasReadAccess]
 
     def get(self, request):
         serializer = TcsObjectGroupsListSerializer(data=request.GET, context={'request': request})
@@ -232,7 +232,8 @@ class TcsObjectGroupsListView(APIView):
 
 class TcsObjectGroupsDeleteView(APIView):
     authentication_classes = [ExpiringTokenAuthentication, QueryAuthentication]
-    permission_classes = [IsAuthenticated&IsApprovedUser]
+    # TODO: Change this to HasDeleteAccess?
+    permission_classes = [IsAuthenticated&HasWriteAccess]
 
     def get(self, request):
         return Response({"Error": "GET is not implemented for this service."})
@@ -255,7 +256,7 @@ class TcsObjectGroupsDeleteView(APIView):
 #                appropriate to the circumstances. E.g. if object is not found generate a 404, etc.
 class VRARankView(APIView):
     authentication_classes = [ExpiringTokenAuthentication, QueryAuthentication]
-    permission_classes = [IsAuthenticated&IsApprovedUser]
+    permission_classes = [IsAuthenticated&HasWriteAccess]
 
     def get(self, request):
         return Response({"Error": "GET is not implemented for this service."})
@@ -272,7 +273,7 @@ class VRARankView(APIView):
 # 2024-05-22 KWS Added VRARankListView.
 class VRARankListView(APIView):
     authentication_classes = [ExpiringTokenAuthentication, QueryAuthentication]
-    permission_classes = [IsAuthenticated&IsApprovedUser]
+    permission_classes = [IsAuthenticated&HasReadAccess]
 
     def get(self, request):
         serializer = VRARankListSerializer(data=request.GET, context={'request': request})
@@ -292,7 +293,7 @@ class VRARankListView(APIView):
 # 2024-09-24 KWS Added ExternalCrossmatchesListView.
 class ExternalCrossmatchesListView(APIView):
     authentication_classes = [ExpiringTokenAuthentication, QueryAuthentication]
-    permission_classes = [IsAuthenticated&IsApprovedUser]
+    permission_classes = [IsAuthenticated&HasReadAccess]
 
     def get(self, request):
         serializer = ExternalCrossmatchesListSerializer(data=request.GET, context={'request': request})
@@ -312,7 +313,7 @@ class ExternalCrossmatchesListView(APIView):
 # 2024-09-24 KWS Added ExternalCrossmatchesListView.
 class ObjectDetectionListView(APIView):
     authentication_classes = [ExpiringTokenAuthentication, QueryAuthentication]
-    permission_classes = [IsAuthenticated&IsApprovedUser]
+    permission_classes = [IsAuthenticated&HasWriteAccess]
 
     def get(self, request):
         serializer = ObjectDetectionListSerializer(data=request.GET, context={'request': request})