deleted packages (state=deleted) cannot be read by the owner

[JoshData]

This causes the v1/2 REST package update API to fail with access denied because after successfully updating the package, the user no longer has permission to read it to generate the dict-like response.

Revised the auth logic to treat 'deleted' like 'draft', meaning only editors can read these packages.

Maybe there's a better way to do this.

[TomDunham]

Yup that's the current behaviour, but I can see there's an argument for that json being available after the package has been deleted. I think there might be some subtleties around it though - should ckan respond with http 410 for instance? Can you give a bit more detail about why you want to be able to see all the json for a deleted package?

[JoshData]

Sorry my description wasn't clear.

Using the update API to delete the package results in a 403, even though it successfully sets the state to deleted. It should return a 200. That's the problem I'm trying to solve.

As for reading the package later- It is possible for the owner to un-delete a package. If the owner can POST to the package, he ought also to be able to GET it too. But that's not what's getting in my way.

[tobes]

Using the update API to delete the package

Could you give the url so I know exactly which path you are taking. I think we can fix this in a less invasive way

[JoshData]

curl http://..../api/2/rest/dataset/some-dataset -d '{"state":"deleted"}' -H "Authorization: ...."

[tobes]

does this fix the problem for you?

basically it stops the auth check when getting the dataset to return as you had the right to update it.

diff --git a/ckan/logic/action/update.py b/ckan/logic/action/update.py
index c5d8e60..7e7e7fa 100644
--- a/ckan/logic/action/update.py
+++ b/ckan/logic/action/update.py
@@ -286,6 +286,7 @@ def package_update(context, data_dict):

     return_id_only = context.get('return_id_only', False)

+    context['ignore_auth'] = True
     output = data_dict['id'] if return_id_only \
             else _get_action('package_show')(context, {'id': data_dict['id']})

[JoshData]

Thanks I'll test that and will let you know.

[tobes]

@tauberer did you get a chance to test this?

[JoshData]

Sorry for the delay. I've been on other projects.

Yes, that works fine.

Thanks!

[tobes]

pull request for the fix #545

[TomDunham]

Closing this off as it's covered elsewhere.

[tobes]

re opening as issue still not resolved

[amercader]

@tobes @domoritz @TomDunham I'm a little confused about this pull request and #545 , which apparently was the fix but is different from this one.
Are the two different issues? Does #545 still need to go to 2.0?

[tobes]

@amercader #545 is wanted this is not closing