Skip to content

fix: ensure authentication for tii group attachment api #722

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
b0ink merged 1 commit into from
Oct 23, 2026
Merged

fix: ensure authentication for tii group attachment api #722

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions app/api/tii/tii_group_attachment_api.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,10 @@ class TiiGroupAttachmentApi < Grape::API
helpers AuthorisationHelpers
include LogHelper

before do
authenticated?
end

desc 'Get the group attachments for a given task definition'
get '/units/:unit_id/task_definitions/:task_def_id/tii_group_attachments' do
unit = Unit.find(params[:unit_id])
Expand Down
20 changes: 20 additions & 0 deletions test/api/tii/tii_group_attachment_api_test.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,6 +34,26 @@ def app
)
end

def test_group_attachments_require_authentication
clear_auth_header
path = "/api/units/#{@unit.id}/task_definitions/#{@task_def.id}/tii_group_attachments"
attachment = @task_def.tii_group_attachments.first

get path
assert_equal 419, last_response.status, last_response_body

put_json "#{path}/#{attachment.id}", { action: 'upload' }
assert_equal 419, last_response.status, last_response_body

delete "#{path}/#{attachment.id}"
assert_equal 419, last_response.status, last_response_body
assert TiiGroupAttachment.exists?(attachment.id)

add_auth_header_for(user: @unit.main_convenor_user, auth_token: 'invalid')
get path
assert_equal 419, last_response.status, last_response_body
end

def test_only_main_convenor_can_access_group_attachments_for_task_definition
tutor = FactoryBot.create(:user, :tutor)
@unit.employ_staff tutor, Role.tutor
Expand Down
Loading