Rest services not respecting isPrivate - Githubissues

AtlasOfLivingAustralia / species-lists

Tool for managing species lists in the ALA

1 stars 0 forks source link

Rest services not respecting isPrivate #86

Open adam-collins opened 4 months ago

adam-collins commented 4 months ago

Rest services not respecting isPrivate.

To reproduce

Create a private list
Access REST service /speciesList/, /speciesListItem/, etc, without JWT
The private list is listed and items are available but should not be

I have not checked graphql service.

I have not checked other REST services.

Task

Permit admin to see all lists and content.
Permit users to see and access their own private lists included in REST requests.
Permit users to see and access lists they have edit permissions for in REST requests and UI.