/users/:user/orgs returns all organizations

[bmamlin]

GET /users/:user/orgs is expected to return the user's organizations (orgs to which the user is a member); however, it appears to be returning all orgs.

I believe the associated code is here.

This is a blocker for the OCL for OpenMRS MVP release.

[snyaggarwal]

I believe its happing because of is_staff flag -- https://github.com/OpenConceptLab/oclapi/blob/d36d286a931064b8275f224f1f6212327ae65827/ocl/orgs/views.py#L45

[bmamlin]

Testing in QA it appears that I am a member of no orgs, yet my org list includes 21 orgs.

http https://api.qa.openconceptlab.org/users/burke/ "Authorization: Token xxxx"
HTTP/1.1 200 OK

{
  "organizations_url": "/users/burke/orgs/",
  "orgs": 0,
  ...
}

http https://api.qa.openconceptlab.org/users/burke/orgs/ "Authorization: Token xxxx"
HTTP/1.1 200 OK
next: https://api.qa.openconceptlab.org/users/burke/orgs/?page=2
num_found: 21
num_returned: 10

[
  ...
]

The same behavior is seen on staging & production. I am not a member of any orgs, yet a query for my orgs (/users/burke/orgs/) returns ~140 orgs.

[harpatel1]

I have identified the issue. Looks like filters are causing this behavior.
https://github.com/OpenConceptLab/oclapi/blob/master/ocl/orgs/filters.py#L17

[snyaggarwal]

Can you please list down the expectations for following URLs:
GET /orgs/ -- unauthenticated user
GET /orgs/ -- authenticated user
GET /orgs/ -- superadmin (or is_staff) user
GET /users/:user/orgs/

[harpatel1]

Here is what I think behavior should be:

GET /orgs/

• Anonymous user - Return all Public orgs
• Authenticated user (not is_staff) - Return all Public orgs + any orgs that user is member of
• Superuser - Returns all orgs regardless public or private

GET /users/:user/orgs/

• Authenticated user (not is_staff) - Only return orgs that user is member of

[snyaggarwal]

Cool, I will update that in oclapi2

[harpatel1]

@bmamlin Fix is deployed in QA and Staging.

[bmamlin]

@harpatel1 QA is working as expected, but staging still returns all orgs.

$ http -h https://api.qa.openconceptlab.org/users/burke/orgs/ "Authorization: Token $OCL_QA_TOKEN" | grep num_found:
num_found: 0

$ http -h https://api.staging.openconceptlab.org/users/burke/orgs/ "Authorization: Token $OCL_STAGING_TOKEN" | grep num_found:
num_found: 153