stash

backend/toolshed/api/files.py

@@ -11,29 +11,29 @@ from toolshed.models import InventoryItem, WorkflowInstance
 
 
 def _get_authorized_item(identity, item_id):
-    """Look up an item by its owner-scoped id and confirm identity may act on it - either as its
-    personal owner (requires a local ToolshedUser account) or as a current member of its owning
-    group (works for a remote member too, since group membership is identity-level, see
-    docs/design-in-progress/groups-mvp.md). id is only unique within one owner/group's own items,
-    so the lookup itself must be scoped rather than a bare global get. Returns None if not found
-    or not authorized, the same shape InventoryItem.DoesNotExist handling around it already
-    expects."""
+    """Owner-or-group-scoped item lookup; returns None if identity may not act on it."""
     if identity.user.exists():
         try:
             return InventoryItem.objects.get(owner=identity.user.get(), id=item_id)
         except InventoryItem.DoesNotExist:
             pass
-    try:
-        return InventoryItem.objects.get(owner_group__in=identity.member_of_groups.all(), id=item_id)
-    except InventoryItem.DoesNotExist:
-        return None
+    # Checked one group at a time, not owner_group__in=<all>, since id is only unique within one group's own items and a combined query could raise MultipleObjectsReturned on a collision.
+    for group in identity.member_of_groups.all():
+        item = InventoryItem.objects.filter(owner_group=group, id=item_id).first()
+        if item:
+            return item
+    return None
 
 
 @api_view(['GET'])
 @permission_classes([IsAuthenticated])
 @authentication_classes([SignatureAuthenticationLocal])
 def list_all_files(request, format=None):  # /files/
-    files = File.objects.select_related().filter(connected_items__owner=request.user).distinct()
+    # request.user is a ToolshedUser here; reach group membership via public_identity.
+    files = File.objects.select_related().filter(
+        Q(connected_items__owner=request.user) |
+        Q(connected_items__owner_group__in=request.user.public_identity.member_of_groups.all())
+    ).distinct()
     return Response(FileSerializer(files, many=True).data)