fix: logic to bypass project_admin if public beta

hotosm · Feb 26, 2024 · 1a4f6bb · 1a4f6bb
1 parent 7a6ca5c
commit 1a4f6bb
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 4 deletions.
diff --git a/src/backend/app/auth/roles.py b/src/backend/app/auth/roles.py
@@ -90,8 +90,16 @@ async def check_access(
                     WHEN EXISTS (
                         SELECT 1
                         FROM organisations
-                        WHERE organisations.id = :org_id
-                        AND organisations.slug = 'fmtm-public-beta'
+                        WHERE (organisations.id = :org_id
+                            AND organisations.slug = 'fmtm-public-beta')
+                        OR EXISTS (
+                            SELECT 1
+                            FROM projects
+                            JOIN organisations AS org
+                                ON projects.organisation_id = org.id
+                            WHERE org.slug = 'fmtm-public-beta'
+                                AND projects.id = :project_id
+                        )
                     ) THEN true
                     ELSE
                         EXISTS (

diff --git a/src/backend/app/projects/project_routes.py b/src/backend/app/projects/project_routes.py
@@ -822,7 +822,7 @@ async def get_or_set_data_extract(
     url: Optional[str] = None,
     project_id: int = Query(..., description="Project ID"),
     db: Session = Depends(database.get_db),
-    org_user_dict: db_models.DbUser = Depends(project_admin),
+    project_user_dict: db_models.DbUser = Depends(project_admin),
 ):
     """Get or set the data extract URL for a project."""
     fgb_url = await project_crud.get_or_set_data_extract_url(
@@ -839,7 +839,7 @@ async def upload_custom_extract(
     custom_extract_file: UploadFile = File(...),
     project_id: int = Query(..., description="Project ID"),
     db: Session = Depends(database.get_db),
-    org_user_dict: db_models.DbUser = Depends(project_admin),
+    project_user_dict: db_models.DbUser = Depends(project_admin),
 ):
     """Upload a custom data extract geojson for a project.