fix: proper permissions for schema endpoints

bento-platform · Sep 17, 2024 · c811bbd · c811bbd
1 parent 827bd4f
commit c811bbd
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 7 deletions.
diff --git a/chord_metadata_service/experiments/api_views.py b/chord_metadata_service/experiments/api_views.py
@@ -4,9 +4,9 @@
 from rest_framework import mixins, serializers, status, viewsets
 from rest_framework.settings import api_settings
 from rest_framework.decorators import api_view, permission_classes
-from rest_framework.permissions import AllowAny
 from rest_framework.response import Response
 
+from chord_metadata_service.authz.permissions import BentoAllowAny
 from chord_metadata_service.discovery.scope import get_request_discovery_scope
 from chord_metadata_service.restapi.api_renderers import (
     FHIRRenderer,
@@ -142,7 +142,7 @@ def dispatch(self, *args, **kwargs):
     }
 )
 @api_view(["GET"])
-@permission_classes([AllowAny])
+@permission_classes([BentoAllowAny])
 def get_experiment_schema(_request):
     """
     get:
@@ -153,7 +153,7 @@ def get_experiment_schema(_request):
 
 
 @api_view(["GET"])
-@permission_classes([AllowAny])
+@permission_classes([BentoAllowAny])
 def get_experiment_subschema(_request, subschema: str):
     """
     get:

diff --git a/chord_metadata_service/phenopackets/api_views.py b/chord_metadata_service/phenopackets/api_views.py
@@ -4,10 +4,9 @@
 from rest_framework import serializers, status, viewsets
 from rest_framework.settings import api_settings
 from rest_framework.decorators import api_view, permission_classes
-from rest_framework.permissions import AllowAny
 from rest_framework.response import Response
 
-from chord_metadata_service.authz.permissions import BentoPhenopacketDataPermission
+from chord_metadata_service.authz.permissions import BentoPhenopacketDataPermission, BentoAllowAny
 from chord_metadata_service.discovery.scope import get_request_discovery_scope
 from chord_metadata_service.restapi.api_renderers import (
     PhenopacketsRenderer,
@@ -258,7 +257,7 @@ class InterpretationViewSet(PhenopacketsModelViewSet):
     }
 )
 @api_view(["GET"])
-@permission_classes([AllowAny])
+@permission_classes([BentoAllowAny])
 def get_chord_phenopacket_schema(_request):
     """
     get:
@@ -269,7 +268,7 @@ def get_chord_phenopacket_schema(_request):
 
 
 @api_view(["GET"])
-@permission_classes([AllowAny])
+@permission_classes([BentoAllowAny])
 def get_chord_phenopacket_subschema(_request, subschema: str):
     """
     get: