Clarify access model in ReviewRequest.get_draft().
Review Request #14011 — Created July 3, 2024 and submitted
Our
get_draft()
method has two modes. If no arguments are given, it
will always return the existing draft. If a user was passed in, we'd
return the draft only if the review request was owned by that user.In some places, we were fetching the draft using the no-args version and
then doing our own access control checks. We also had at least one bug
that I remember where we were passing the user in and it broke the
ability for admins to reassign review requests, because we weren't
fetching the draft for them in the publish operation. This inconsistency
was also making it so we were showing admins the draft data, but they
were unable to load draft diff fragments.This change makes it so when passing a user in to get_draft(), we will
return the draft if that user has access to the draft, not just if it
matches the owner of the review request.
- Ran js-tests.
- Verified that as an admin I could now view all draft data on a
review request owned by another user. - Audited calls to get_draft() to ensure that everything was using it in
the correct way.
Summary | ID |
---|---|
df00e2e7ac81a1d403d69784c4295af7a08eae08 |
Description | From | Last Updated |
---|---|---|
over-indented Column: 17 Error code: E117 |
![]() |
|
For these calls, can we start passing in user= on these? Might be nice to transition all access check methods … |
|
|
**kwargs |
|
|
The "for modify" kinda reads strangely. |
|
|
Is this something that we should document further with a "Version Changed"? |
![]() |
|
Missing type. |
![]() |
|
Missing *args and **kwargs docs. |
![]() |
- Commits:
-
Summary ID 6e67e712970193cd41cb001244874cc7d9a10b32 e22a963662c650219be81846b2e7edcbca8bedbd - Diff:
-
Revision 2 (+260 -74)
Checks run (2 succeeded)
- Commits:
-
Summary ID e22a963662c650219be81846b2e7edcbca8bedbd f24a91f09a780554105bec98e1edfedcac75e6ca - Diff:
-
Revision 3 (+260 -74)
Checks run (2 succeeded)
- Commits:
-
Summary ID f24a91f09a780554105bec98e1edfedcac75e6ca df00e2e7ac81a1d403d69784c4295af7a08eae08 - Diff:
-
Revision 4 (+290 -76)