documents: removes permssions from the search list

pyproject.toml

@@ -31,7 +31,7 @@ invenio-theme = ">=2.5.7,<3.0.0"
 
 # Invenio auth bundle
 invenio-access = ">=2.0.0,<3.0.0"
-invenio-accounts = ">=3.0.0,<4.0.0"
+invenio-accounts = ">=3.5.2,<4.0.0"
 invenio-oauth2server = ">=2.0.0,<3.0.0"
 invenio-oauthclient = ">=3.0.0,<4.0.0"
 invenio-userprofiles = "^2.3.1"

sonar/modules/documents/marshmallow/json.py

@@ -149,7 +149,7 @@ class DocumentListMetadataSchemaV1(StrictKeysMixin):
     customField3 = fields.List(fields.String(validate=validate.Length(min=1)))
     masked = SanitizedUnicode()
     _bucket = SanitizedUnicode()
-    _files = Nested(FileSchemaV1, many=True)
+    _files = Nested(ThumbnailSchemaV1, many=True)
     _oai = fields.Dict()
     # When loading, if $schema is not provided, it's retrieved by
     # Record.schema property.

tests/api/documents/test_documents_rest.py

@@ -23,6 +23,21 @@
 from invenio_accounts.testutils import login_user_via_session
 
 
+def test_get(client, document_with_file):
+    """Get REST methods."""
+    res = client.get(url_for('invenio_records_rest.doc_list', view='global'))
+    assert res.status_code == 200
+    assert res.json['hits']['total']['value'] == 1
+    # the search results does not contains permissions
+    assert not res.json['hits']['hits'][0]['metadata']['_files'][0].get("permissions")
+
+    # the item result should contains permissions
+    res = client.get(url_for('invenio_records_rest.doc_item', pid_value=document_with_file['pid']))
+    assert res.status_code == 200
+    assert res.json['metadata']['_files'][0]['permissions'] == {
+        'delete': False, 'read': False,'update': False}
+
+
 def test_put(app, client, document_with_file):
     """Test putting metadata on existing file."""
     # Disable configuration