akvo / akvo-mis
89%
main: 89%

LAST BUILD BRANCH: feature/273-two-phase-registration
DEFAULT BRANCH: main
Repo Added
Files 113
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

LAST BUILD ON BRANCH feature/273-two-phase-registration
branch: SELECT
CHANGE BRANCH
x

coverage: 88.879%. First build
#778

Pull #285

coveralls-python

zuhdil 
[#273] Scope approval batches, and make role names unique per tenant

Two gaps the read-isolation iteration left behind, found while checking
the role endpoint.

**Batches were readable across workspaces by guessing an id.** Five
endpoints — the batch's data, its comments, its summary, its attachments
— each fetched `DataBatch` by the id in the URL without asking whose it
was. Those ids are sequential, so any authenticated submitter or approver
in any workspace could walk another's pending submissions. Queryset-level
filtering could never have caught this: the lookup does not go through a
list.

`DataBatch` now carries the tenant path the read-isolation spec already
assigned it but which was never implemented, and one `batch_for` helper
asks the ownership question so a sixth endpoint cannot forget to.

**Role names were globally unique**, so the second workspace to want a
"Data Entry" role could not have one — an integrity error with no
sensible message. Uniqueness is now per tenant.

That needs the tenant stored on the role rather than derived through its
level, because a unique constraint cannot span a join. The column is
denormalised, so `save` sets it from `administration_level.tenant` and
nothing else can: it is not an input. `TENANT_PATH` follows it to the
direct column. The migration backfills from each role's level before the
constraint is added — leaving the column NULL would make every existing
role look like it belonged to one tenant-less workspace, and two legacy
roles sharing a name would collide.

The isolation tests pair each refusal with the same request against the
caller's own batch, because a route that does not exist also answers 404.

Still unaddressed, and deliberately: `RoleAccess`, `RoleFeatureAccess`
and `QuestionOptions` were also given paths by that spec and still lack
them. Each is only reachable through a parent that is scoped, so none is
currently exposed.
Pull Request #285: [#273] Verify the email before the workspace exists

5772 of 6671 branches covered (86.52%)

Branch coverage included in aggregate %.

10996 of 12195 relevant lines covered (90.17%)

0.9 hits per line

Relevant lines Covered
12195 RELEVANT LINES 10996 COVERED LINES
0.9 HITS PER LINE
Source Files on main

Recent builds

Builds Branch Commit Type Ran Committer Via Coverage
#778 feature/273-two-phase-registration [#273] Scope approval batches, and make role names unique per tenant Two gaps the read-isolation iteration left behind, found while checking the role endpoint. **Batches were readable across workspaces by guessing an id.** Five endpoints — the b... Pull #285 zuhdil coveralls-python
88.88
#777 HEAD Merge 1b9ff6a46 into b9905c879 push web-flow coveralls-python
88.88
#776 feature/273-two-phase-registration [#273] Scope approval batches, and let two tenants share a role name Two gaps the read-isolation iteration left behind, found while checking the role endpoint. **Batches were readable across workspaces by guessing an id.** Five endpoints — the b... Pull #285 zuhdil coveralls-python
88.88
#775 HEAD Merge 691caacd2 into b9905c879 push web-flow coveralls-python
88.87
#774 HEAD Merge ef7087147 into ca88641e4 push web-flow coveralls-python
88.79
#773 epic/multi-tenant-saas [#271] Enforce tenant ownership on every write (#282) * [#271] Add the tenant stamping mixin and scoped related field Two write-side mechanisms mirroring the read-side for_user. The stamping mixin sets a new row's tenant from the authenticated u... Pull #280 web-flow coveralls-python
88.79
#772 feature/271-tenant-write-path [#271] Trim the write-enforcement diff Complexity-only pass; no behaviour change. - acting_user picked the first non-None of two context keys across six lines. A user object is always truthy, so `or` says the same thing in one expression. -... Pull #282 zuhdil coveralls-python
88.79
#771 HEAD Merge 3ff7ea08b into ca88641e4 push web-flow coveralls-python
88.74
#770 epic/multi-tenant-saas [#270] Filter every read by tenant (#281) * [#270] Add the for_user tenant-scoping mechanism Each tenant-owned model declares TENANT_PATH — the ORM lookup to its owning tenant, "tenant" for direct-FK tables and a join like "form__tenant" for der... Pull #280 web-flow coveralls-python
88.74
#769 HEAD Merge 217092319 into 44d171b4c push web-flow coveralls-python
88.8
See All Builds (777)