Skip to content

Commit

Permalink
Check for ADMIN before DB call in get_owner
Browse files Browse the repository at this point in the history
  • Loading branch information
jterry64 committed May 10, 2024
1 parent 38b1e64 commit 18164f1
Showing 1 changed file with 6 additions and 3 deletions.
9 changes: 6 additions & 3 deletions app/routes/datasets/dataset.py
Original file line number Diff line number Diff line change
Expand Up @@ -28,12 +28,15 @@
async def get_owner(
dataset: str = Depends(dataset_dependency), user: User = Depends(get_manager)
) -> User:
"""Retrieves the user object that owns the dataset if that user is the one
making the request, otherwise raises a 401."""
"""Returns the User making the request as long as that user is an admin or
the owner of the dataset, otherwise raises a 401."""

if user.role == "ADMIN":
return user

dataset_row: ORMDataset = await datasets.get_dataset(dataset)
owner: str = dataset_row.owner_id
if owner != user.id and user.role != "ADMIN":
if owner != user.id:
raise HTTPException(status_code=401, detail="Unauthorized")
return user

Expand Down

0 comments on commit 18164f1

Please sign in to comment.