Release 2026.2.7.2 - #858
Merged
Merged
Conversation
fetch_score_set_by_urn's owner_or_contributor filter led with ScoreSet.private.is_(False), which only_published already guarantees. The two arguments constrained the same column and the looser subsumed the stricter, so passing user_data narrowed nothing: the call collapsed to an Action.READ check on a published score set, which every caller passes. Any authenticated user could record their own score set as the successor to any published one, and because replaces_id is unique, the first claim permanently blocked the real owner from superseding their own work. Drop the public-visibility disjunct so the argument means what its name and the docstring say. The other three call sites pass None and are unaffected. Supersession still has no Action of its own, so the authorization remains the shape of the query rather than a permission handler; the call site now says so. Contributors are admitted alongside owners, matching the documented rule -- broader than _handle_publish_action, which is owner-only, and worth settling when Action.SUPERSEDE lands.
…arch /experiments/search has no auth dependency, and build_search_experiments_query_filter narrows by owner or contributor rather than by visibility -- the router passes None. Unlike /score-sets/search it never constrained published, which defaults to None and applies no filter at all, so an empty request body returned every unpublished experiment in the database, with its title, abstract, method text and owner ORCID iD. Force published to true and reject an explicit false, mirroring the score set endpoint. Unpublished experiments stay reachable through /me/experiments/search, which is unchanged. The UI only ever called that route, so no client change is required. Three tests asserted the old behaviour, one of them checking that another user's given name came back. The replacements assert against one published and one unpublished experiment matching the same search text, so they fail whether the filter is missing or too aggressive.
…rch results enrich_experiment_with_num_score_sets is what filters a nested experiment's score_set_urns by permission, and /score-sets/search ran it only when the request left includeExperimentScoreSetUrnsAndCount unset or true. Sent false, the ORM experiment reached SavedExperiment.generate_score_set_urn_list directly, which lists every score set on the experiment, disclosing the tmp URNs of private ones and their count. SearchView sends false, so this was the served behaviour of the main search page rather than an opt-in path. Remove the field rather than defaulting it safe: the response cannot be correct with the filter off, so it should not be expressible. The view models do not forbid extra fields, so a client still sending it is unaffected. The enrichment is now unconditional on that route, which costs it roughly 1.3ms per result, or about 130ms at the 100-result limit SearchView requests. Building ShortScoreSet rather than ScoreSet in the loop recovers most of that, since the response model narrows to ShortScoreSet anyway; held back as a separate change.
…tings /target-genes/names and /target-genes/categories are unauthenticated and aggregate the whole target_genes table with no join to scoresets, so they disclosed the gene symbols and categories under assay in unpublished work. Neither route names an entity to assert a permission on, and both sibling routes in the module already filter. Join the parent score set and require a published date -- the same predicate the statistics routes use through _join_model_and_filter_unpublished. Keeping these two on that shape means the RLS work retires them together rather than one at a time.
Coverage Report for CI Build 32538749194Coverage increased (+0.02%) to 88.962%Details
Uncovered ChangesNo uncovered changes found. Coverage Regressions5 previously-covered lines in 1 file lost coverage.
Coverage Stats
💛 - Coveralls |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Features
NA
Bug Fixes
Maintenance
NA