PIMS-1625: Parcel and Building view details agency authorization #2353
Conversation
|
🚀 Deployment Information The Express API Image has been built with the tag: |
|
Code Climate has analyzed commit d1da9cc and detected 0 issues on this pull request. The test coverage on the diff in this pull request is 75.0% (50% is the threshold). This pull request will bring the total coverage in the repository to 95.6%. View more on Code Climate. |
|
Right now, it seems like this isn't checking if I'm an admin or auditor. I should be able to see properties based on that. |
Good catch! I'll refactor these 2 gets to use that function. |
dbarkowsky
left a comment
There was a problem hiding this comment.
Seems to be working for me.
Prevented me from retrieving details of a parcel that wasn't under my agency.
🎯 Summary
PIMS-1625: - Parcel and Building view details agency authorization
Adding authorization checks to prevent a user from viewing a parcel or a building not belonging to their agency.
To test you can try as a "General user" by editing the url and changing the id of the parcel or building to one that has an agency which doesn't belong to your user's agency.
🔰 Checklist