Some key differences vs other routes * Does not assume linked to project * Does not assume user (could be api auth) So anyone with the link is the hash Public is something else Permissions a) Auth by including project b) Auth by some extra "link" or code
()
| 20 | methods = ['POST']) |
| 21 | @swag_from('../../../docs/files/file_view.yml') |
| 22 | def view_file_by_id(): # Assumes permissions handled later with Project_permissions |
| 23 | """ |
| 24 | |
| 25 | Some key differences vs other routes |
| 26 | |
| 27 | * Does not assume linked to project |
| 28 | * Does not assume user (could be api auth) |
| 29 | |
| 30 | So anyone with the link is the hash |
| 31 | Public is something else |
| 32 | |
| 33 | Permissions |
| 34 | a) Auth by including project |
| 35 | b) Auth by some extra "link" or code (could follow similar |
| 36 | structure for "share by " links |
| 37 | |
| 38 | with_labels is a future id if we do auth without project |
| 39 | |
| 40 | In context of video mode, including all instances |
| 41 | in single go no longer makes sense |
| 42 | |
| 43 | The main difference from "task" is that it uses the project permissions |
| 44 | and it's "just" for a single file, which does not have to relate to a |
| 45 | task. |
| 46 | Relevant for admins, and in future could be relevant for say |
| 47 | inference results, or input verification / jumping to, etc. |
| 48 | |
| 49 | """ |
| 50 | spec_list = [{'file_id': int}, |
| 51 | {'project_string_id': str}, |
| 52 | {'serialize_type': {'type': str, 'required': False}}] |
| 53 | |
| 54 | log, input, untrusted_input = regular_input.master(request = request, |
| 55 | spec_list = spec_list) |
| 56 | if len(log["error"].keys()) >= 1: |
| 57 | return jsonify(log = log), 400 |
| 58 | |
| 59 | with_labels = False |
| 60 | label_dict = {} |
| 61 | file_serialized = None |
| 62 | |
| 63 | with sessionMaker.session_scope() as session: |
| 64 | |
| 65 | Project_permissions.by_project_core( |
| 66 | project_string_id = input['project_string_id'], |
| 67 | Roles = ["admin", "Editor", "Viewer", "allow_if_project_is_public"]) |
| 68 | |
| 69 | project = Project.get( |
| 70 | session = session, |
| 71 | project_string_id = input['project_string_id']) |
| 72 | |
| 73 | member = get_member(session) |
| 74 | policy_engine = PolicyEngine(session = session, project = project) |
| 75 | perm_result = policy_engine.member_has_perm( |
| 76 | object_id = input['file_id'], |
| 77 | object_type = ValidObjectTypes.file, |
| 78 | perm = FilePermissions.file_view, |
| 79 | member = member |
nothing calls this directly
no test coverage detected