Esri / Esri/solution.js

deleteSolution fails when items are not owned by authenticated user

Open
#818 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
48
Forks
16
PR merge metrics
No merged PRs in 30d

Description

I'm trying to use the `deleteSolution` function on a solution item that is not owned by me. My account is an admin account and is allowed to delete these items in general.

Running the `getDeletableSolutionInfo` function beforehand does return the items I am expecting to delete.

When `deleteSolution` runs, it fails on the step of unprotecting the items it wants to delete, as witnessed in the dev tools network tab. Specifically, I think the issue is that it is trying to use an incorrect unprotect URL. If my user is `user1` and the item is owned by `user2`, it is attempting to unprotect using `https://key.maps.arcgis.com/sharing/rest/content/users/user1/items/{itemId}/unprotect` (note it's using a path including `user1`), where the correct URL would be for the user who owns the item, not who is attempting to complete the unprotect operation: `https://key.maps.arcgis.com/sharing/rest/content/users/user2/items/{itemId}/unprotect`

Ideally, `getDeletableSolutionInfo` might check if the current user has privileges to delete the item, and then `deleteSolution` would use the correct URL based on the owning user to unprotect and delete the item.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.