deleteSolution fails when items are not owned by authenticated user
- Dominant language
- TypeScript
- Stars
- 48
- Forks
- 16
- PR merge metrics
- No merged PRs in 30d
Description
I'm trying to use the `deleteSolution` function on a solution item that is not owned by me. My account is an admin account and is allowed to delete these items in general.
Running the `getDeletableSolutionInfo` function beforehand does return the items I am expecting to delete.
When `deleteSolution` runs, it fails on the step of unprotecting the items it wants to delete, as witnessed in the dev tools network tab. Specifically, I think the issue is that it is trying to use an incorrect unprotect URL. If my user is `user1` and the item is owned by `user2`, it is attempting to unprotect using `https://key.maps.arcgis.com/sharing/rest/content/users/user1/items/{itemId}/unprotect` (note it's using a path including `user1`), where the correct URL would be for the user who owns the item, not who is attempting to complete the unprotect operation: `https://key.maps.arcgis.com/sharing/rest/content/users/user2/items/{itemId}/unprotect`
Ideally, `getDeletableSolutionInfo` might check if the current user has privileges to delete the item, and then `deleteSolution` would use the correct URL based on the owning user to unprotect and delete the item.
Contributor guide
Assessment
This issue has not been assessed yet.