Adding admin dependency in authorization of dataset,files, metadata,search

[ddey2]

For testing, please use endpoints on Postman or Clowder UI. Both should work.

[ddey2]

Hold on to review this one. I need to do some testing.

[lmarini]

The line return DatasetDB.creator.email == current_username.email at authentication.py:100 is returning {'creator.email': '<current user email address>'} for some reason, which in turn is making all the if admin statements true, even if the user is not admin.

[tcnichol]

Question on this one.

I have 2 users in my db right now. One is an admin, and one is not.

If I create a dataset with the non-admin user and upload files, the admin sees the dataset under explore, but when they click the dataset they do not see the files.

But if I download the dataset, they are downloaded.

If I try to access one of the files directly, this error is in the console:

6565073147e9aeb9a3876b75:1 Access to fetch at 'http://localhost:8000/api/v2/authorizations/files/6565073147e9aeb9a3876b75/role' from origin 'http://localhost:3000' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.

[ddey2]

@tcnichol Could you check the same issue here in this branch? #834
I see that you approved that PR. If we can merge the other one, it should be taken care of in this branch and we can merge it to main then. The super-admin branch contains a lot of other change too on top of this one which takes care of a lot of the functionalities.

[tcnichol]

looks good. other admin features in another pull request, also approved.

[longshuicy]

Test a few scenarios all works:

• Admin seeing other person's resources
• Admin search
• Non-Admin see resources only through sharing
• etc

If you fix the merge conflict we can merge :-)

[ddey2]

Test a few scenarios all works:

• Admin seeing other person's resources
• Admin search
• Non-Admin see resources only through sharing
• etc

If you fix the merge conflict we can merge :-)

done

It's been addressed by Dipannita