Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Feature/package approve #3

Open
wants to merge 17 commits into
base: master
Choose a base branch
from
Open

Feature/package approve #3

wants to merge 17 commits into from

Conversation

zelima
Copy link
Contributor

@zelima zelima commented Nov 30, 2018

  • Add a custom validator (using get_validators from IValidators) that unless the user is an admin/sysadmin sets the value to approval_pending.
  • Add the state field to the dataset schema, adding the previous validator validator to it. Hide it from the form for now (form_snippet: False)
  • If the user is an Editor, add notice on the form about the dataset needing review (templates/package/new_package_form.html) and show "Request Dataset" instead of "Create Dataset".
    • Uses is_admin(user) helper function to determine editor -> If user is not admin + can create package means user is editor
  • Datasets with state set to approval_pending should not be displayed in the search results (/dataset or API)
  • Logged-in and Anonymous Users should not be able to access a pending dataset (UI or API). Extend the package_show auth function (if necessary)



@toolkit.side_effect_free
def package_search(context, data_dict):
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This should be done in the IPackageController.before_search hook. In general is best to avoid overriding actions if possible

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We need to rethink the whole way pending datasets will be handled on the search. Probably using IPermissionLabels, as we will need to search for pending datasets at some point. But let's go with this for now.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@amercader so is this fine? Or refactor to use before_search?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, please. Use before_search

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed in 8edd1ad

@@ -24,26 +24,31 @@ def get_groups():
return groups


def get_recently_updated_datasets(limit=5):
def get_recently_updated_datasets(limit=5, user=None):
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why was this needed? FYI, if you don't explicitly provide a user in the context CKAN will use the one logged in.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Forget to mention in PR description. Did this cause we probably don't want pending datasets to appear in recently updated and the most popular dataset. Both get_recently_updated_datasets and get_most_popular_datasets use package_show that awaits user in context to check if one can views dataset.

Copy link
Contributor Author

@zelima zelima Nov 30, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

FYI, if you don't explicitly provide a user in the context CKAN will use the one logged in.

@amercader hmm... now I remember, the main reason was, cause tests started failing I think.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The avoiding of pending datasets coming up should he handled at the search level. The implementation of get_recently_updated_datasets is wrong as you don't need to call package_show, you have all the info you need in the results returned by package_search.

Anyway if you relied on the check on package_show you would get a NotFound exception which is probably not what you want.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@zelima can you revisit this and see if the change is actually needed?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed in 9f0d999

amercader and others added 5 commits November 30, 2018 13:29
call_action sets ignore_auth=True by default, which basically means that
everybody can `package_update`, so the the check on `package_show`
doesn't work. Also simplified the tests when possible.
@zelima zelima mentioned this pull request Dec 4, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants