Restrict access to detailed obfuscated results

medizininformatik-initiative / feasibility-backend

Backend of the feasibility-gui.

Apache License 2.0

2 stars 5 forks source link

Closed juliangruendner closed 10 months ago

juliangruendner commented 1 year ago

A user should only be able to access his own results, unless he is an admin.

For this the following should be added to the detailed-obfuscated-result endpoint similar to other endpoints:

if (!hasAccess(queryId, authentication)) {
      return new ResponseEntity<>(HttpStatus.FORBIDDEN);
    }