simpler authorization check for accessing aggregation metadata
@@ -1201,11 +1201,10 @@ def get_metadata(request, hs_file_type, file_type_id, metadata_mode):
from hs_core.views.utils import authorize
from rest_framework.exceptions import PermissionDenied
- if not logical_file.resource.raccess.public:
- if request.user.is_authenticated:
- authorize(request, logical_file.resource.short_id,
- needed_permission=ACTION_TO_AUTHORIZE.VIEW_RESOURCE)
- else:
+
+ _, authorized, _ = authorize(request, logical_file.resource.short_id,
+ needed_permission=ACTION_TO_AUTHORIZE.VIEW_RESOURCE, raises_exception=False)
+ if not authorized:
raise PermissionDenied()
if json_response is not None:
