udata 10.3.3.dev35068__py2.py3-none-any.whl → 10.3.3.dev35091__py2.py3-none-any.whl

udata/core/dataservices/api.py

@@ -54,8 +54,11 @@ class DataserviceAPI(API):
     @api.doc("get_dataservice")
     @api.marshal_with(Dataservice.__read_fields__)
     def get(self, dataservice):
-        if dataservice.deleted_at and not OwnablePermission(dataservice).can():
-            api.abort(410, "Dataservice has been deleted")
+        if not OwnablePermission(dataservice).can():
+            if dataservice.private:
+                api.abort(404)
+            elif dataservice.deleted_at:
+                api.abort(410, "Dataservice has been deleted")
         return dataservice
 
     @api.secure

udata/core/dataset/api.py

@@ -300,8 +300,11 @@ class DatasetAPI(API):
     @api.marshal_with(dataset_fields)
     def get(self, dataset):
         """Get a dataset given its identifier"""
-        if dataset.deleted and not DatasetEditPermission(dataset).can():
-            api.abort(410, "Dataset has been deleted")
+        if not DatasetEditPermission(dataset).can():
+            if dataset.private:
+                api.abort(404)
+            elif dataset.deleted:
+                api.abort(410, "Dataset has been deleted")
         return dataset
 
     @api.secure

udata/core/reuse/api.py

@@ -138,8 +138,11 @@ class ReuseAPI(API):
     @api.marshal_with(Reuse.__read_fields__)
     def get(self, reuse):
         """Fetch a given reuse"""
-        if reuse.deleted and not ReuseEditPermission(reuse).can():
-            api.abort(410, "This reuse has been deleted")
+        if not ReuseEditPermission(reuse).can():
+            if reuse.private:
+                api.abort(404)
+            elif reuse.deleted:
+                api.abort(410, "This reuse has been deleted")
         return reuse
 
     @api.secure

udata/tests/api/test_dataservices_api.py

@@ -1,3 +1,4 @@
+from datetime import datetime
 from xml.etree.ElementTree import XML
 
 import pytest
@@ -17,7 +18,7 @@ from udata.core.organization.factories import OrganizationFactory
 from udata.core.organization.models import Member
 from udata.core.user.factories import AdminFactory, UserFactory
 from udata.i18n import gettext as _
-from udata.tests.helpers import assert200, assert400, assert_redirects
+from udata.tests.helpers import assert200, assert400, assert410, assert_redirects
 
 from . import APITestCase
 
@@ -30,6 +31,40 @@ def dataservice_in_response(response: TestResponse, dataservice: Dataservice) ->
 class DataserviceAPITest(APITestCase):
     modules = []
 
+    def test_dataservice_api_get(self):
+        """It should fetch a dataservice from the API"""
+        dataservice = DataserviceFactory()
+        response = self.get(url_for("api.dataservice", dataservice=dataservice))
+        assert200(response)
+
+    def test_dataservice_api_get_deleted(self):
+        """It should not fetch a deleted dataservice from the API and raise 410"""
+        dataservice = DataserviceFactory(deleted_at=datetime.utcnow())
+        response = self.get(url_for("api.dataservice", dataservice=dataservice))
+        assert410(response)
+
+    def test_dataservice_api_get_deleted_but_authorized(self):
+        """It should fetch a deleted dataservice from the API if authorized"""
+        user = self.login()
+        dataservice = DataserviceFactory(deleted_at=datetime.utcnow(), owner=user)
+        response = self.get(url_for("api.dataservice", dataservice=dataservice))
+        assert200(response)
+
+    def test_dataservice_api_get_private(self):
+        """It should not fetch a private dataservice from the API and raise 404"""
+        dataservice = DataserviceFactory(private=True)
+
+        response = self.get(url_for("api.dataservice", dataservice=dataservice))
+        self.assert404(response)
+
+    def test_dataservice_api_get_private_but_authorized(self):
+        """It should fetch a private dataservice from the API if user is authorized"""
+        self.login()
+        dataservice = DataserviceFactory(owner=self.user, private=True)
+
+        response = self.get(url_for("api.dataservice", dataservice=dataservice))
+        self.assert200(response)
+
     def test_dataservices_api_list_with_filters(self):
         """Should filters dataservices results based on query filters"""
         org = OrganizationFactory()
@@ -174,10 +209,10 @@ class DataserviceAPITest(APITestCase):
         response = self.get(url_for("api.dataservice", dataservice=dataservice))
         self.assert200(response)
 
-        # We cannot access deleted element as random user
+        # We cannot access private element as random user
         self.login()
         response = self.get(url_for("api.dataservice", dataservice=dataservice))
-        self.assert410(response)
+        self.assert404(response)
 
         # We can undelete with a patch
         self.login(user)

udata/tests/api/test_datasets_api.py

@@ -484,13 +484,28 @@ class DatasetAPITest(APITestCase):
         self.assert410(response)
 
     def test_dataset_api_get_deleted_but_authorized(self):
-        """It should a deleted dataset from the API if user is authorized"""
+        """It should fetch a deleted dataset from the API if user is authorized"""
         self.login()
         dataset = DatasetFactory(owner=self.user, deleted=datetime.utcnow())
 
         response = self.get(url_for("api.dataset", dataset=dataset))
         self.assert200(response)
 
+    def test_dataset_api_get_private(self):
+        """It should not fetch a private dataset from the API and raise 404"""
+        dataset = DatasetFactory(private=True)
+
+        response = self.get(url_for("api.dataset", dataset=dataset))
+        self.assert404(response)
+
+    def test_dataset_api_get_private_but_authorized(self):
+        """It should fetch a private dataset from the API if user is authorized"""
+        self.login()
+        dataset = DatasetFactory(owner=self.user, private=True)
+
+        response = self.get(url_for("api.dataset", dataset=dataset))
+        self.assert200(response)
+
     def test_dataset_api_create(self):
         """It should create a dataset from the API"""
         data = DatasetFactory.as_dict()

udata/tests/api/test_reuses_api.py

@@ -257,6 +257,21 @@ class ReuseAPITest:
         response = api.get(url_for("api.reuse", reuse=reuse))
         assert200(response)
 
+    def test_reuse_api_get_private(self, api):
+        """It should not fetch a private reuse from the API and raise 404"""
+        reuse = ReuseFactory(private=True)
+
+        response = api.get(url_for("api.reuse", reuse=reuse))
+        assert404(response)
+
+    def test_reuse_api_get_private_but_authorized(self, api):
+        """It should fetch a private reuse from the API if user is authorized"""
+        user = api.login()
+        reuse = ReuseFactory(owner=user, private=True)
+
+        response = api.get(url_for("api.reuse", reuse=reuse))
+        assert200(response)
+
     def test_reuse_api_create(self, api):
         """It should create a reuse from the API"""
         data = ReuseFactory.as_dict()

{udata-10.3.3.dev35068.dist-info → udata-10.3.3.dev35091.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: udata
-Version: 10.3.3.dev35068
+Version: 10.3.3.dev35091
 Summary: Open data portal
 Home-page: https://github.com/opendatateam/udata
 Author: Opendata Team
@@ -142,6 +142,7 @@ It is collectively taken care of by members of the
 ## Current (in progress)
 
 - Improve reuse api perfs by adding a mask on datasets [#3309](https://github.com/opendatateam/udata/pull/3309)
+- Private objects should return 404 by api [#3311](https://github.com/opendatateam/udata/pull/3311)
 - Add `featured` to dataset default mask [#3313](https://github.com/opendatateam/udata/pull/3313)
 
 ## 10.3.2 (2025-05-06)

{udata-10.3.3.dev35068.dist-info → udata-10.3.3.dev35091.dist-info}/RECORD

@@ -81,7 +81,7 @@ udata/core/contact_point/factories.py,sha256=YoW2PKKaemYO4lIy5MwpH36uXM_J3rE-Ihs
 udata/core/contact_point/forms.py,sha256=oBe1agSJFyx2QRgYzPRg2A7qVscaBTaKG4V-AyIwnF8,729
 udata/core/contact_point/models.py,sha256=Xqmqg7S13gcaKxiQT52WHeQEHTaUDDGIXInXyqNh4Po,854
 udata/core/dataservices/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-udata/core/dataservices/api.py,sha256=aX9f4cDT_7XYjES5lY-ar-sC1z-xopiPrL-vPuB1nkc,7303
+udata/core/dataservices/api.py,sha256=7jOn3Ug63-5wjXP0d_zL0whdCQeHG_eQ1Y-wNhUuPLM,7388
 udata/core/dataservices/apiv2.py,sha256=XIqJq58uLtxtt52iKYo7Fl0ZXv9Sz72uA7JIGwP8Qos,995
 udata/core/dataservices/constants.py,sha256=LBCTQ44YvjTZfQVbxFiovPxapAknSJNOZKjMP8WeFy4,351
 udata/core/dataservices/csv.py,sha256=pcNIeGaCzBMMna3n3YqHjsoXzfLtg_ITtDmdKb9svDc,1053
@@ -94,7 +94,7 @@ udata/core/dataservices/tasks.py,sha256=d2tG1l6u8-eUKUYBOgnCsQLbLmLgJXU-DOzZWhhL
 udata/core/dataset/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 udata/core/dataset/actions.py,sha256=mX6xox0PiMrbcAPZ3VZsI26rfM-ciYfEXxN6sqqImKA,1222
 udata/core/dataset/activities.py,sha256=v8k1jwhdx62Z2ARZq8Q-x86OWSsBK99hRloPl74OCgA,1502
-udata/core/dataset/api.py,sha256=Xif5NcmxXMrTnDwWi3RKfzIp_FxlYVTVcYCgPi2g0M0,33120
+udata/core/dataset/api.py,sha256=gMpY3w1BhXtPPiHC7UZ0bfIFyp34Jwio0NaUmwutmVg,33201
 udata/core/dataset/api_fields.py,sha256=SLuzWoPdMLPX28WQ9DRGUPKS27vlltiFeiTo6jXa55Q,17549
 udata/core/dataset/apiv2.py,sha256=5tBsbEbF7kjUHP0X9Xd6qDSI9bqNBgYvRaWs0n3r1OM,17803
 udata/core/dataset/commands.py,sha256=__hPAk_6iHtgMnEG51ux0vbNWJHxUjXhi1ukH4hF5jY,3714
@@ -174,7 +174,7 @@ udata/core/reports/constants.py,sha256=LRZSX3unyqZeB4yQjK3ws_hGbJcXYk4bu1Rhnhi5D
 udata/core/reports/models.py,sha256=AsW5p2ZIdR4c6vNzglEN7MX03It-t9u7ktOsVZqvzSs,2702
 udata/core/reuse/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 udata/core/reuse/activities.py,sha256=mAdHhqqpUF5zSh4e5AEo0J7alc3RflTbudDaKOzyTQw,1406
-udata/core/reuse/api.py,sha256=JIT7-kUf6l0BSW3hSdRHjS0OM5eJxdlFGdXUESzLBKY,10849
+udata/core/reuse/api.py,sha256=931cn6CGVcHv0XhSAXyjHkKy-9nOGHaHdE3uMU8v9mc,10928
 udata/core/reuse/api_fields.py,sha256=c61Gl56UjiBpXS0Nbvcoi_QHdUmhnBtqWm6nNHRYKyc,1232
 udata/core/reuse/apiv2.py,sha256=nZe-v8713aXKuv2B578NdxfrIckjbxhS3zUXAKSIKTI,835
 udata/core/reuse/constants.py,sha256=JgDBrjOKSt9q0auv9rjzbGsch83H-Oi8YXAKeI5hO4o,1215
@@ -625,14 +625,14 @@ udata/tests/api/test_activities_api.py,sha256=RjDDeNle3T-ydVnh6BRypqxAE_244-DXaK
 udata/tests/api/test_auth_api.py,sha256=OMRlY0OQt60j5N4A-N3HdWTuffOjRlFHkz5a3jJFieI,25987
 udata/tests/api/test_base_api.py,sha256=2w_vz0eEuq3P3aN-ByvxGc3VZAo7XtgatFfcrzf2uEU,2244
 udata/tests/api/test_contact_points.py,sha256=X_RWD_xCfR8WchhHfKEt5mxMHY77OmTyguNKCsZftdE,5337
-udata/tests/api/test_dataservices_api.py,sha256=jntjiLUWfAeFj-8VW3szcHLSNKSp8qFopUDAC5bxWuY,24102
-udata/tests/api/test_datasets_api.py,sha256=Cp0SeDjj_Yjf3aNcSStHbFm4kaxIAn8rOCIpX60I7aM,94261
+udata/tests/api/test_dataservices_api.py,sha256=fNpeHl4SMvci3QrC414X6KGorv7NS1y8LsGxcSMjjZY,25729
+udata/tests/api/test_datasets_api.py,sha256=0MuIxHimP24waJPu91aXR1HOyBO_YgsPp7KOkB8hkuk,94872
 udata/tests/api/test_fields.py,sha256=OW85Z5MES5HeWOpapeem8OvR1cIcrqW-xMWpdZO4LZ8,1033
 udata/tests/api/test_follow_api.py,sha256=XP6I96JUNT6xjGcQOF7pug_T_i67HzCiOGLaPdpfpEQ,4912
 udata/tests/api/test_me_api.py,sha256=YPd8zmR3zwJKtpSqz8nY1nOOMyXs66INeBwyhg5D0Us,13846
 udata/tests/api/test_organizations_api.py,sha256=-jV2By1qkcxtrm57jVKqKa8nvvCCohGUz63QT9uZgZQ,41209
 udata/tests/api/test_reports_api.py,sha256=fCSz9NwMXBs6cxdXBVVI6y564AtovmZYw3xkgxQ9KE8,6217
-udata/tests/api/test_reuses_api.py,sha256=d8mtUrDURIfnUK-sLogvAP-rOID2FDJ0UVTM0ravQ-Q,24642
+udata/tests/api/test_reuses_api.py,sha256=x7SG8tNmuPDAaK-t0E_Y02-_5g4o8t7dnVdfgE1Qu08,25218
 udata/tests/api/test_swagger.py,sha256=eE6La9qdTYTIUFevRVPJgtj17Jq_8uOlsDwzCNR0LL8,760
 udata/tests/api/test_tags_api.py,sha256=36zEBgthVEn6pctJ0kDgPmEaUr-iqRAHeZRcRG2LEXQ,2425
 udata/tests/api/test_topics_api.py,sha256=beIPbDA8PHo4FZogeio-j1MO6Eatt9oFSlp-aHpgEtQ,12200
@@ -726,9 +726,9 @@ udata/translations/pt/LC_MESSAGES/udata.mo,sha256=ViV14tUmjSydHS0TWG_mFikKQfyUaT
 udata/translations/pt/LC_MESSAGES/udata.po,sha256=rzAD_MVoV54TmN3w1ECz3H2Ru5pM7hWMVH03SkY28Q8,47250
 udata/translations/sr/LC_MESSAGES/udata.mo,sha256=EHX1_D-Uglj38832G7BrA0QC5IuY3p8dKqi9T0DgPmE,29169
 udata/translations/sr/LC_MESSAGES/udata.po,sha256=3PMnbVhKVJh6Q8ABi1ZTZ8Dcf-sMjngLJZqLbonJoec,54225
-udata-10.3.3.dev35068.dist-info/LICENSE,sha256=V8j_M8nAz8PvAOZQocyRDX7keai8UJ9skgmnwqETmdY,34520
-udata-10.3.3.dev35068.dist-info/METADATA,sha256=ryDQc1Wt1G4ENdYlyst4xltkRgWebQtZ9E9Pc21DC_Q,145583
-udata-10.3.3.dev35068.dist-info/WHEEL,sha256=Kh9pAotZVRFj97E15yTA4iADqXdQfIVTHcNaZTjxeGM,110
-udata-10.3.3.dev35068.dist-info/entry_points.txt,sha256=ETvkR4r6G1duBsh_V_fGWENQy17GTFuobi95MYBAl1A,498
-udata-10.3.3.dev35068.dist-info/top_level.txt,sha256=39OCg-VWFWOq4gCKnjKNu-s3OwFlZIu_dVH8Gl6ndHw,12
-udata-10.3.3.dev35068.dist-info/RECORD,,
+udata-10.3.3.dev35091.dist-info/LICENSE,sha256=V8j_M8nAz8PvAOZQocyRDX7keai8UJ9skgmnwqETmdY,34520
+udata-10.3.3.dev35091.dist-info/METADATA,sha256=xmwqnPVt3J6JKkTa3QniKR_hmPu9B1pxhmpMACyd6_c,145683
+udata-10.3.3.dev35091.dist-info/WHEEL,sha256=Kh9pAotZVRFj97E15yTA4iADqXdQfIVTHcNaZTjxeGM,110
+udata-10.3.3.dev35091.dist-info/entry_points.txt,sha256=ETvkR4r6G1duBsh_V_fGWENQy17GTFuobi95MYBAl1A,498
+udata-10.3.3.dev35091.dist-info/top_level.txt,sha256=39OCg-VWFWOq4gCKnjKNu-s3OwFlZIu_dVH8Gl6ndHw,12
+udata-10.3.3.dev35091.dist-info/RECORD,,