restriction added - With data-view based user role only asset browser read operation is allowed
@@ -85,6 +85,13 @@ async def auth_middleware(app, handler):
# With "view" based user role only read access operation is allowed
if int(request.user["role_id"]) == 3 and request.method != 'GET':
raise web.HTTPForbidden
+ # With "data-view" based user role only browser asset read operation is allowed
+ if int(request.user["role_id"]) == 4:
+ if request.method == 'GET':
+ if not str(request.path).startswith('/fledge/asset'):
+ raise web.HTTPForbidden
+ else:
+ raise web.HTTPForbidden
except(User.InvalidToken, User.TokenExpired) as e:
raise web.HTTPUnauthorized(reason=e)
except (jwt.DecodeError, jwt.ExpiredSignatureError) as e:
