PrevEmployment: add auth + ownership check to PATCH/DELETE/proof endpoints
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 66/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Active
- Domain
- api, authentication, authorization, testing
Research direction
Start with api/routers/prev_employment.py and inspect how get_current_student and the ownership check are used for the related issue #138. Apply the same authentication and 404 behavior to the three listed endpoints, then add integration tests for unauthenticated, other-user, and owner requests. Done means all three endpoint cases behave as specified.
Written by the indexing model from the issue text.
Description
Problem
These endpoints in api/routers/prev_employment.py have no auth dependency and do no ownership check, so anyone can modify, delete or upload proof for any previous-employment entry by id:
PATCH /prev_employments/{prev_employment_id}/proofDELETE /prev_employments/{prev_employment_id}PATCH /prev_employments/{prev_employment_id}
Tasks
- Require
get_current_student - Ownership check: entry must have
user_account == user["sub"]; otherwise 404 (no existence leak, consistent with #138) - Integration tests: unauthenticated → 401; other user's entry → 404; owner → success
Related: #138
- Dominant language
- Python
- Stars
- 0
- Forks
- 0
- Avg merge
- 39m
- Merged PRs (30d)
- 10
Getting set up
- Ships a Dockerfile or Docker Compose file
- No pull request template
- No contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from ClockGU/clockwork-backend
-
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
ClockGU/clockwork-backend#169 ·
Maintainers usually reply within 1 day
-
Difficulty 4/5 3-5 days Newbie friendliness 20/100
ClockGU/clockwork-backend#165 ·
Maintainers usually reply within 1 day
-
Difficulty 5/5 Over a week Newbie friendliness 20/100
ClockGU/clockwork-backend#164 ·
Maintainers usually reply within 1 day
-
Difficulty 5/5 Over a week Newbie friendliness 20/100
ClockGU/clockwork-backend#163 ·
Maintainers usually reply within 1 day
-
Difficulty 5/5 Over a week Newbie friendliness 25/100
ClockGU/clockwork-backend#162 ·
Maintainers usually reply within 1 day
All issues in ClockGU/clockwork-backend
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
-
Validate finite output clamping limits in StepPredictor.prepare_clamping_params to prevent silent NaN/Inf propagationPossibly taken @muskan-creates352 claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
mllam/neural-lam#848 ·
Maintainers usually reply within 2 days
-
infra
Difficulty 1/5 Under an hour Newbie friendliness 88/100
fab-geocommuns/RNB-coeur#1166 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
deepspeedai/DeepSpeed#8951 ·
Maintainers usually reply within 2 days
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
aws/context-ontology-accelerator#343 ·
Maintainers usually reply within 1 day