Function checkPublicAccess

server/api/ChartRoute.js:106–153

(req, requiredAccess)

  };

  const checkPublicAccess = async (req, requiredAccess) => {
    const chart = await chartController.findById(req.params.chart_id);
    if (!chart) {
      return Promise.reject(404);
    }

    const projectId = req.params.project_id || chart.project_id;
    const project = await projectController.findById(projectId);
    if (!project || `${chart.project_id}` !== `${project.id}`) {
      return Promise.reject(401);
    }

    if (!chart.onReport) {
      return Promise.reject(401);
    }

    const hasAuthenticatedProjectAccess = await hasProjectReadAccess(project, req.user);

    if (!project.public && !hasAuthenticatedProjectAccess) {
      return Promise.reject(401);
    }

    const passwordInput = getPublicPasswordInput(req);
    if (project.passwordProtected && passwordInput !== project.password && !hasAuthenticatedProjectAccess) {
      return Promise.reject(401);
    }

    const sharePolicy = await db.SharePolicy.findOne({
      where: {
        entity_type: "Project",
        entity_id: project.id,
      },
    });

    const hasSharePolicyAccess = await verifyProjectSharePolicyAccess(req, project, sharePolicy);
    if (!hasSharePolicyAccess && !hasAuthenticatedProjectAccess) {
      return Promise.reject(401);
    }

    if (requiredAccess === "export") {
      const team = await teamController.findById(project.team_id);
      if (!team?.allowReportExport) {
        return Promise.reject(401);
      }
    }

    return { chart, project, hasAuthenticatedProjectAccess };
  };

  const resolveRuntimeVariables = async (req, project, providedVariables = {}) => {
    const queryParams = req.body?.queryParams || {};