fix: proper permissions for schema endpoints

bento-platform · Sep 17, 2024 · b12fd9a · b12fd9a
1 parent 3c7e196
commit b12fd9a
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 6 deletions.
diff --git a/chord_metadata_service/experiments/api_views.py b/chord_metadata_service/experiments/api_views.py
@@ -3,13 +3,13 @@
 from rest_framework import mixins, serializers, status, viewsets
 from rest_framework.settings import api_settings
 from rest_framework.decorators import api_view, permission_classes
-from rest_framework.permissions import AllowAny
 from rest_framework.response import Response
 
 from .serializers import ExperimentSerializer, ExperimentResultSerializer
 from .models import Experiment, ExperimentResult
 from .schemas import EXPERIMENT_SCHEMA, experiment_resolver, experiment_base_uri
 from .filters import ExperimentFilter, ExperimentResultFilter
+from chord_metadata_service.authz.permissions import BentoAllowAny
 from chord_metadata_service.restapi.constants import MODEL_ID_PATTERN
 from chord_metadata_service.restapi.pagination import LargeResultsSetPagination, BatchResultsSetPagination
 
@@ -140,7 +140,7 @@ def dispatch(self, *args, **kwargs):
     }
 )
 @api_view(["GET"])
-@permission_classes([AllowAny])
+@permission_classes([BentoAllowAny])
 def get_experiment_schema(_request):
     """
     get:
@@ -151,7 +151,7 @@ def get_experiment_schema(_request):
 
 
 @api_view(["GET"])
-@permission_classes([AllowAny])
+@permission_classes([BentoAllowAny])
 def get_experiment_subschema(_request, subschema: str):
     """
     get:

diff --git a/chord_metadata_service/phenopackets/api_views.py b/chord_metadata_service/phenopackets/api_views.py
@@ -2,9 +2,9 @@
 from rest_framework import viewsets
 from rest_framework.settings import api_settings
 from rest_framework.decorators import api_view, permission_classes
-from rest_framework.permissions import AllowAny
 from rest_framework.response import Response
 
+from chord_metadata_service.authz.permissions import BentoAllowAny
 from chord_metadata_service.restapi.api_renderers import (
     PhenopacketsRenderer,
     FHIRRenderer,
@@ -231,7 +231,7 @@ class InterpretationViewSet(PhenopacketsModelViewSet):
     }
 )
 @api_view(["GET"])
-@permission_classes([AllowAny])
+@permission_classes([BentoAllowAny])
 def get_chord_phenopacket_schema(_request):
     """
     get:
@@ -242,7 +242,7 @@ def get_chord_phenopacket_schema(_request):
 
 
 @api_view(["GET"])
-@permission_classes([AllowAny])
+@permission_classes([BentoAllowAny])
 def get_chord_phenopacket_subschema(_request, subschema: str):
     """
     get: