fix (CRB): hotfix 3.16.13 rights check on crb (#299)

aphp · Dec 8, 2023 · e7d82ea · e7d82ea
1 parent d87310a
commit e7d82ea
Show file tree

Hide file tree

Showing 3 changed files with 18 additions and 3 deletions.
diff --git a/accesses/tools/perimeter_process.py b/accesses/tools/perimeter_process.py
@@ -205,7 +205,7 @@ def get_perimeters_filtered_by_search(cohort_ids, owner_id, default_perimeters):
         return default_perimeters
 
 
-def get_read_nominative_boolean_from_specific_logic_function(perimeters_filtered_by_search, filter_queryset,
+def get_read_nominative_boolean_from_specific_logic_function(perimeters_filtered_by_search,
                                                              all_read_patient_nominative_accesses,
                                                              all_read_patient_pseudo_accesses,
                                                              right_perimeter_compute_function) -> bool:

diff --git a/cohort/crb/cohort_requests/abstract_cohort_request.py b/cohort/crb/cohort_requests/abstract_cohort_request.py
@@ -19,8 +19,7 @@
 def is_cohort_request_pseudo_read(auth_headers: dict, source_population: list) -> bool:
     user = get_user_from_token(auth_headers['Authorization'].replace('Bearer ', ''),
                                auth_headers['authorizationMethod'])
-    all_read_patient_nominative_accesses, all_read_patient_pseudo_accesses = get_all_read_patient_accesses(
-        user)
+    all_read_patient_nominative_accesses, all_read_patient_pseudo_accesses = get_all_read_patient_accesses(user)
     return not get_read_nominative_boolean_from_specific_logic_function(source_population,
                                                                         all_read_patient_nominative_accesses,
                                                                         all_read_patient_pseudo_accesses,

diff --git a/cohort/tests/test_crb.py b/cohort/tests/test_crb.py
@@ -2,6 +2,10 @@
 from pathlib import Path
 from unittest import mock
 
+from django.http import Http404
+
+from admin_cohort.models import User
+from cohort.crb.cohort_requests.abstract_cohort_request import is_cohort_request_pseudo_read
 from cohort.crb.enums import ResourceType
 from cohort.crb.exceptions import FhirException
 from cohort.crb.query_formatter import QueryFormatter
@@ -88,3 +92,15 @@ def test_format_to_fhir_complex_query(self, query_fhir):
         self.assertEquals(ResourceType.PATIENT, res_criteria.resource_type)
         self.assertEquals(self.fq_value_string, res_criteria.filter_solr, )
         self.assertEquals("patient-active=true&codeList=A00-B99", res_criteria.filter_fhir)
+
+    @mock.patch("cohort.crb.cohort_requests.abstract_cohort_request.get_user_from_token")
+    def test_cohort_request_pseudo_read(self, mock_get_user_from_token):
+        mock_get_user_from_token.return_value = User.objects.create(firstname='Test',
+                                                                    lastname='USER',
+                                                                    email='[email protected]',
+                                                                    provider_username='1111111')
+        auth_headers = {"Authorization": "Bearer XXX",
+                        "authorizationMethod": "OIDC"}
+        with self.assertRaises(Http404):
+            is_cohort_request_pseudo_read(auth_headers=auth_headers, source_population=[])
+        mock_get_user_from_token.assert_called()