Skip to content

Fix Allow any valid user access to public Dataset through SDK - #335

Closed
mjcurran wants to merge 9 commits into
masterfrom
mjcurran/fix-allow-access-to-public-datasets
Closed

Fix Allow any valid user access to public Dataset through SDK#335
mjcurran wants to merge 9 commits into
masterfrom
mjcurran/fix-allow-access-to-public-datasets

Conversation

@mjcurran

@mjcurran mjcurran commented Aug 21, 2026

Copy link
Copy Markdown
Collaborator

SFDS-320
Fix permission issues trying to access assets of public datasets

  • If a Dataset is public then allow a valid user to have Viewer permissions to download through SDK.

Note

Medium Risk
Changes authorization rules for datasets, captures, and files; incorrect is_public handling could expose or over-restrict assets, though scope is limited to the intended public flag.

Overview
Fixes SDK and API access for public datasets, captures, and linked files when there is no explicit UserSharePermission row.

Permission model: UserSharePermission.get_user_permission_level now returns viewer for any authenticated check path when the target dataset or capture has is_public=True (and is not deleted), after owner and explicit share checks fail.

Access control utilities: user_has_access_to_capture, user_has_access_to_file, and the get_accessible_*_queryset helpers treat is_public like an implicit grant— including nested paths (files on public captures, files on captures in public datasets, files linked to public datasets, and directly public files).

Tests: Adds coverage that an unshared user sees public M2M-linked files and captures in the accessible querysets.

Reviewed by Cursor Bugbot for commit 5ad9ea1. Bugbot is set up for automated code reviews on this repo. Configure here.

Comment thread gateway/sds_gateway/api_methods/models.py
Comment thread gateway/sds_gateway/api_methods/models.py
@lucaspar lucaspar added bug Something isn't working sdk SDK component gateway Gateway component labels Aug 21, 2026
Comment thread gateway/sds_gateway/api_methods/utils/asset_access_control.py
Comment thread gateway/sds_gateway/api_methods/utils/asset_access_control.py
@mjcurran
mjcurran requested review from klpoland and lucaspar August 21, 2026 19:01

@lucaspar lucaspar left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks. It'd be good to add some regression tests to make sure this keeps working in the future.

Comment thread gateway/sds_gateway/api_methods/utils/asset_access_control.py

@cursor cursor Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

Fix All in Cursor

❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.

Reviewed by Cursor Bugbot for commit 09f09f4. Configure here.

Comment thread gateway/sds_gateway/api_methods/utils/asset_access_control.py
@lucaspar

lucaspar commented Aug 25, 2026

Copy link
Copy Markdown
Member

Merged as 265d341

@mjcurran I forgot to mention to force a push on your branch when there are things to rebase. Full flow:

# rebase
git switch mjcurran/fix-allow-access-to-public-datasets
git fetch
git rebase origin/master

# force push (forgot this):
git push origin --force-with-lease
# so this PR could be automatically closed

# switch to default branch, merge, and push:
git switch master
git merge --ff-only mjcurran/fix-allow-access-to-public-datasets
git push origin

@lucaspar lucaspar closed this Aug 25, 2026
@lucaspar
lucaspar deleted the mjcurran/fix-allow-access-to-public-datasets branch August 25, 2026 16:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working gateway Gateway component sdk SDK component

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants