logout is also allowed with view and data view user type
@@ -83,13 +83,19 @@ async def auth_middleware(app, handler):
# set if user is admin
request.user_is_admin = True if int(request.user["role_id"]) == 1 else False
# With "view" based user role only read access operation is allowed
+ # logout is also allowed
if int(request.user["role_id"]) == 3 and request.method != 'GET':
+ if not str(request.path).endswith('/logout'):
raise web.HTTPForbidden
# With "data-view" based user role only browser asset read operation is allowed
- if int(request.user["role_id"]) == 4:
+ # logout is also allowed
+ elif int(request.user["role_id"]) == 4:
if request.method == 'GET':
if not str(request.path).startswith('/fledge/asset'):
raise web.HTTPForbidden
+ elif request.method == 'PUT':
+ if not str(request.path).endswith('/logout'):
+ raise web.HTTPForbidden
else:
raise web.HTTPForbidden
except(User.InvalidToken, User.TokenExpired) as e:
