Skip to content

Fix Allow any valid user access to public Dataset through SDK - #335

Open
mjcurran wants to merge 6 commits into
masterfrom
mjcurran/fix-allow-access-to-public-datasets
Open

Fix Allow any valid user access to public Dataset through SDK#335
mjcurran wants to merge 6 commits into
masterfrom
mjcurran/fix-allow-access-to-public-datasets

Conversation

@mjcurran

@mjcurran mjcurran commented Aug 21, 2026

Copy link
Copy Markdown
Collaborator

SFDS-320
Fix permission issues trying to access assets of public datasets

  • If a Dataset is public then allow a valid user to have Viewer permissions to download through SDK.

Note

High Risk
Widens authorization: any logged-in user can view/download assets on public datasets and captures. Incomplete coverage of deprecated FK query paths could also leave access inconsistent.

Overview
Authenticated users now get viewer access to public datasets and captures (and their nested files/captures) without an explicit share, so SDK downloads of public dataset assets work.

UserSharePermission.get_user_permission_level falls back to PermissionLevel.VIEWER when the item is public and not deleted. Capture/file access helpers and the accessible-files/captures querysets treat is_public like ownership or a share on M2M relationships (deprecated FK paths are unchanged).

Reviewed by Cursor Bugbot for commit ea7aaf7. Bugbot is set up for automated code reviews on this repo. Configure here.

Comment thread gateway/sds_gateway/api_methods/models.py
Comment thread gateway/sds_gateway/api_methods/models.py
@lucaspar lucaspar added bug Something isn't working sdk SDK component gateway Gateway component labels Aug 21, 2026
Comment thread gateway/sds_gateway/api_methods/utils/asset_access_control.py

@cursor cursor Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

Fix All in Cursor

❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.

Reviewed by Cursor Bugbot for commit 199e050. Configure here.

Comment thread gateway/sds_gateway/api_methods/utils/asset_access_control.py
@mjcurran
mjcurran requested review from klpoland and lucaspar August 21, 2026 19:01

@lucaspar lucaspar left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks. It'd be good to add some regression tests to make sure this keeps working in the future.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working gateway Gateway component sdk SDK component

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants