search

cph-cachet / carp-webservices-spring

REST-based implementation of the CARP Core Domain Model using Spring Boot in Kotlin
https://carp.cachet.dk/
MIT License
3 stars 1 forks source link

Download from file endpoint returns 403 Forbidden - Access Denied #111

Closed bardram closed 1 week ago

bardram commented 1 month ago

As a Participant I upload a file, but when trying to download it, I get

CarpServiceException: 403 Forbidden -  Access Denied - GET /api/studies/b7a4d433-c267-4d2c-b182-67bbbc37279b/files/17/download

using the download endpoint = /api/studies/{study-id}/files/{file-id}/download

The get endpoint works fine = /api/studies/{study-id}/files/{file-id}.

Testing on DEV.

yuanchen233 commented 3 weeks ago

Tested with Researcher/Admin account, download endpoint works, FileOwner Claim works, todo: test with participant account

yuanchen233 commented 3 weeks ago

JWT token does not include FileOwner Claim for participant, however, it is set correctly and works properly for researchers. Look into situations where JWT token generation is different for participant and researcher

davidscavnicky commented 2 weeks ago

Tested with Participant/Admin account. Need to look into scenario for Participant:

Upon uploading file with Participant role, the FileOwner attribute is not assigned to JWT token, even though the participant NEEDS to be owner of that file when the person uploaded it in the first place. somehow the name in generation of JWT token is not done properly, have to investigate further with debugging

davidscavnicky commented 2 weeks ago

after assigning fileOwner attribute to participant's token (upload), the token needs to be refreshed and get from Keycloak via already established endpoint. backend's setting and getting of attribute from generated JWT token works correctly, when creating access to file system.

bardram commented 2 weeks ago

Update the Swagger API documentation to include this information.

davidscavnicky commented 1 week ago

Swagger API documentation updated