hackforla / hackforla/peopledepot
Restrict get specific user to users on same team
Open
complexity: large
p-feature: user
PII: FALSE
role: dev
s: org
s: PD team
size: 8pt
- Dominant language
- Python
- Stars
- 14
- Forks
- 37
- Avg merge
- 9d 15h
- Merged PRs (30d)
- 5
Description
### Overview
When fetching a specific user using uuid, you should get an error if user is not on your team (unless you are an admin)
Contributor guide
Research direction
The issue names no files or tests. Locate the API entry point that fetches a user by UUID, then trace its team and admin authorization checks. Done means non-admin users receive an error for users outside their team while admins can still fetch them, with coverage in the relevant API tests.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- api, authorization, backend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100