hackforla / hackforla/peopledepot
eligible-users api - restrict to global admins and project admins
Open
complexity: medium
dependency
ethan
feature: security
milestone: missing
PII: FALSE
role: dev
s: PD team
size: 3pt
- Dominant language
- Python
- Stars
- 14
- Forks
- 37
- Avg merge
- 9d 15h
- Merged PRs (30d)
- 5
Description
### Dependency
- [ ] #394
### Overview
Ensure only valid users can use the API
### API specification
/eligibile-users/
### Action Items
- [ ] permissions.py (& views.py): UserEligiblePermission
- [ ] Validate project id.
- [ ] views.py: Add as a permission to UserEligibleView
- [ ] Check if user is a global admin or project admin. If not, return error.
- [ ] If not a global admin, check that project admin is assigned to the specified project. If not, return errror.
Contributor guide
Assessment
This issue has not been assessed yet.