chore: make permission_classes explicit for search overview

bento-platform · Jan 15, 2025 · 68d4af9 · 68d4af9
1 parent 4902a9c
commit 68d4af9
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/chord_metadata_service/restapi/api_views.py b/chord_metadata_service/restapi/api_views.py
@@ -9,7 +9,7 @@
 
 from chord_metadata_service.authz.helpers import get_data_type_query_permissions
 from chord_metadata_service.authz.middleware import authz_middleware
-from chord_metadata_service.authz.permissions import BentoAllowAny
+from chord_metadata_service.authz.permissions import BentoAllowAny, BentoDeferToHandler
 from chord_metadata_service.chord.data_types import DATA_TYPE_PHENOPACKET, DATA_TYPE_EXPERIMENT
 from chord_metadata_service.discovery.scope import get_request_discovery_scope
 from chord_metadata_service.experiments import models as experiments_models
@@ -46,6 +46,7 @@ def extra_properties_schema_types(_request: DrfRequest):
 
 
 @api_view(["GET", "POST"])
+@permission_classes([BentoDeferToHandler])  # careful here since it's private - mark authz done as we go.
 async def search_overview(request: DrfRequest):
     """
     get+post: