Return 404 if accessing unpublished dataset/entity list

getodk · Sep 12, 2023 · 6f14f17 · 6f14f17
1 parent 2be613d
commit 6f14f17
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 1 deletion.
diff --git a/lib/resources/datasets.js b/lib/resources/datasets.js
@@ -8,10 +8,11 @@
 // except according to the terms contained in the LICENSE file.
 
 const sanitize = require('sanitize-filename');
-const { getOrNotFound } = require('../util/promise');
+const { getOrNotFound, rejectIf } = require('../util/promise');
 const { streamEntityCsv } = require('../data/entity');
 const { contentDisposition, withEtag } = require('../util/http');
 const { md5sum } = require('../util/crypto');
+const { noargs } = require('../util/util');
 const { Dataset } = require('../model/frames');
 const Problem = require('../util/problem');
 
@@ -26,6 +27,7 @@ module.exports = (service, endpoint) => {
     Datasets.get(params.projectId, params.name)
       .then(getOrNotFound)
       .then((dataset) => auth.canOrReject('dataset.read', dataset)
+        .then(rejectIf((() => dataset.publishedAt == null), noargs(Problem.user.notFound)))
         .then(() => Datasets.getMetadata(dataset)))));
 
   service.patch('/projects/:projectId/datasets/:name', endpoint(async ({ Datasets }, { params, body, auth, query }) => {

diff --git a/test/integration/api/datasets.js b/test/integration/api/datasets.js
@@ -572,6 +572,15 @@ describe('datasets and entities', () => {
 
       }));
 
+      it('should reject if dataset is not published', testService((service) =>
+        service.login('alice', (asAlice) =>
+          asAlice.post('/v1/projects/1/forms')
+            .send(testData.forms.simpleEntity)
+            .set('Content-Type', 'application/xml')
+            .expect(200)
+            .then(() => asAlice.get('/v1/projects/1/datasets/people')
+              .expect(404)))));
+
       it('should not return duplicate linkedForms', testService(async (service) => {
         const asAlice = await service.login('alice');