cgwire / zou

Zou is the Kitsu API. It allows you to store and manage your production data
https://zou.cg-wire.com
GNU Affero General Public License v3.0
170 stars 104 forks source link

Cannot fetch metadata-descriptors as an artist or a supervisor #848

Closed ChristopheSeux closed 2 months ago

ChristopheSeux commented 2 months ago

There is a permission restriction in the api that prevent an artist or a supervisor to fetch the metadatadescriptor of a project. In the kitsu interface an artist can see all the metadatas but cannot edit them (Which is good) But with the api it's impossible to get the complete list of metadadescriptor which make it hard as a TD to make custom interfaces. An artist or a supervisor should be able to fetch the complete list of metadadescriptor as there is no sensible information there, but for sure have restricted permissions to edit them

frankrousseau commented 2 months ago

Can you tell us which gazu function you are using or which zou route?

ChristopheSeux commented 2 months ago

The gazu function used are gazu.project.all_metadata_descriptors() and get_metadata_descriptor_by_field_name() The zou routes are "data/projects/%s/metadata-descriptors" % project["id"] and data/metadata-descriptors' I get gazu.exception.NotAllowedException for both. I checked and the artist and the supervisor are in the team of the project

frankrousseau commented 2 months ago

It should be fixed. Can you test it?

ChristopheSeux commented 2 months ago

Sound really good thank you so much, we will test it as soon as possible and get back to you

ChristopheSeux commented 3 weeks ago

I confirm it's working, thank you a lot