Cannot view concepts in private source as an org member

[ibacher]

This was uncovered in production by @michaelbontyes. He couldn't see any concepts in the MSFOCP / BD dictionary that were from the corresponding source (MSFOCP / BD). The source was marked as "private" (i.e. public_access: None). Changing the source to be public public_access: View fixed the issue, but as his account is a member of the MSFOCP organisation, he should be able to see the concepts from that source in his dictionary.

Basically, when he was logged in a request to https://api.openconceptlab.org/orgs/MSFOCP/collections/BD/concepts/?page=1&limit=10&q=&sortAsc=id&source=BD&includeRetired=false returned no results.

[paynejd]

Can you confirm that the correct API token was included in the request header?

…

On Wed, Jul 21, 2021 at 4:04 PM Ian ***@***.***> wrote: This was uncovered in production by @michaelbontyes <https://github.com/michaelbontyes>. He couldn't see any concepts in the MSFOCP / BD dictionary that were from the corresponding source (MSFOCP / BD). The source was marked as "private" (i.e. public_access: None). Changing the source to be public public_access: View fixed the issue, but as his account is a member of the MSFOCP organisation, he should be able to see the concepts from that source in his dictionary. Basically, when he was logged in a request to https://api.openconceptlab.org/orgs/MSFOCP/collections/BD/concepts/?page=1&limit=10&q=&sortAsc=id&source=BD&includeRetired=false returned no results. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#853>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAJCOOKULT54R27CK3XCJWLTY4R4FANCNFSM5AYUQKZA> .

[michaelbontyes]

Hi @paynejd, I was using the OCL for OpenMRS UI (https://openmrs.openconceptlab.org/orgs/MSFOCP/collections/BD/concepts/)

[ibacher]

@paynejd Yeah, we pretty much always send the API token associated with user for every request except to get the list of public dictionaries or public sources (when retrieving the concepts from those dictionaries, though, we do send the API token). I'd assume the API token is correct because it's the one returned by sending a POST request to the login end-point.

I wonder, though, if this might've somehow been related to the API2 migration (MSFOCP was built when we were still using API1)?

[snyaggarwal]

@ibacher I think you are right. It looks like a bug in oclapi2. I will check this.

[snyaggarwal]

@michaelbontyes @ibacher This should be fixed now. Let me know if you still face any issue in this.

[ibacher]

Thanks @snyaggarwal! I'll let you know if this comes up again, but for now, I think we can close this.