Skip to content

GitHub Issue #1462: QCStateAction to check for AssayReadPermission for run container #7979

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
cnathe merged 2 commits into from
Aug 25, 2026
Merged

GitHub Issue #1462: QCStateAction to check for AssayReadPermission for run container #7979

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
0b68e32
GitHub Issue #1462: QCStateAction to check for AssayReadPermission fo…
cnathe Aug 25, 2026
949b959
claude CR feedback
cnathe Aug 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 14 additions & 4 deletions assay/src/org/labkey/assay/AssayController.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1443,20 +1443,30 @@ public ModelAndView getView(UpdateQCStateForm form, BindException errors) throws

if (form.getRuns() != null && !form.getRuns().isEmpty())
{
// GitHub Issue #1462: check permission in each run's own container
List<ExpRun> runs = new ArrayList<>();
for (Long runId : form.getRuns())
{
ExpRun run = ExperimentService.get().getExpRun(runId);
if (run == null || !run.getContainer().hasPermission(getUser(), AssayReadPermission.class))
throw new NotFoundException("Run " + runId + " not found.");
runs.add(run);
}

if (getContainer().hasPermission(getUser(), QCAnalystPermission.class))
{
JspView<UpdateQCStateForm> jspView = new JspView<>("/org/labkey/assay/view/updateQCState.jsp", form, errors);
jspView.setFrame(WebPartView.FrameType.PORTAL);
view.addView(jspView);
}

if (form.getRuns().size() == 1)
if (runs.size() == 1)
{
// construct the audit log query view
// construct the audit log query view. Note: ensureCanSeeAuditLogRole grants the role in every container
User user = ElevatedUser.ensureCanSeeAuditLogRole(getContainer(), getUser());
UserSchema schema = AuditLogService.getAuditLogSchema(user, getContainer());
ExpRun run = ExperimentService.get().getExpRun(form.getRuns().stream().findFirst().get());
if (run != null && schema != null)
ExpRun run = runs.getFirst();
if (schema != null)
{
QuerySettings settings = new QuerySettings(getViewContext(), "auditHistory");
SimpleFilter filter = new SimpleFilter(FieldKey.fromParts("RunLsid"), run.getLSID());
Expand Down