`/private-media/` (used for exports) only works with session authentication

kobotoolbox / kpi

kpi is the server for KoboToolbox. It includes an API for users to access data and manage their forms, question library, sharing settings, create reports, and export data.

https://www.kobotoolbox.org

GNU Affero General Public License v3.0

133 stars 181 forks source link

`/private-media/` (used for exports) only works with session authentication #2338

Closed jnm closed 4 years ago

jnm commented 5 years ago

It should allow all the methods supported by the rest of the API: https://github.com/kobotoolbox/kpi/blob/5d5764be09b42b29c29d32b387d37ee096943e4a/kobo/settings/base.py#L285-L291

Problem is, this isn't a DRF view. Can it be made into / wrapped by a DRF view, or do we need to add some kind of middleware? The endpoint is provided by https://github.com/edoburu/django-private-storage

noliveleger commented 5 years ago

@jnm: Maybe what we did for attachments is enough? https://github.com/kobotoolbox/kobocat/blob/bb826cc10a31d1dd512d2aecab9847641076f635/onadata/apps/viewer/views.py#L714-L727

jnm commented 5 years ago

@noliveleger, yeah. Maybe that logic could go into a function that gets set as PRIVATE_STORAGE_AUTH_FUNCTION, and we won't have to write our own view: https://github.com/edoburu/django-private-storage/blob/v2.1.2/private_storage/views.py#L30-L31

jnm commented 4 years ago

Closed by #2447