From 45b3110e80ea4aa28b56c4a9b2c13d73e6dffa77 Mon Sep 17 00:00:00 2001 From: pieterlukasse Date: Fri, 26 Jan 2024 20:54:16 +0100 Subject: [PATCH] fix: return StatusForbidden instead of StatusBadRequest ...for cases where authorization failed --- controllers/cohortdata.go | 6 +++--- controllers/concept.go | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/controllers/cohortdata.go b/controllers/cohortdata.go index b0b7ae1..7e0ba8c 100644 --- a/controllers/cohortdata.go +++ b/controllers/cohortdata.go @@ -52,7 +52,7 @@ func (u CohortDataController) RetrieveHistogramForCohortIdAndConceptId(c *gin.Co validAccessRequest := u.teamProjectAuthz.TeamProjectValidation(c, []int{cohortId}, cohortPairs) if !validAccessRequest { log.Printf("Error: invalid request") - c.JSON(http.StatusBadRequest, gin.H{"message": "access denied"}) + c.JSON(http.StatusForbidden, gin.H{"message": "access denied"}) c.Abort() return } @@ -101,7 +101,7 @@ func (u CohortDataController) RetrieveDataBySourceIdAndCohortIdAndVariables(c *g validAccessRequest := u.teamProjectAuthz.TeamProjectValidation(c, []int{cohortId}, cohortPairs) if !validAccessRequest { log.Printf("Error: invalid request") - c.JSON(http.StatusBadRequest, gin.H{"message": "access denied"}) + c.JSON(http.StatusForbidden, gin.H{"message": "access denied"}) c.Abort() return } @@ -254,7 +254,7 @@ func (u CohortDataController) RetrieveCohortOverlapStatsWithoutFilteringOnConcep validAccessRequest := u.teamProjectAuthz.TeamProjectValidation(c, []int{caseCohortId, controlCohortId}, cohortPairs) if !validAccessRequest { log.Printf("Error: invalid request") - c.JSON(http.StatusBadRequest, gin.H{"message": "access denied"}) + c.JSON(http.StatusForbidden, gin.H{"message": "access denied"}) c.Abort() return } diff --git a/controllers/concept.go b/controllers/concept.go index 78fd7d8..c32e603 100644 --- a/controllers/concept.go +++ b/controllers/concept.go @@ -102,7 +102,7 @@ func (u ConceptController) RetrieveBreakdownStatsBySourceIdAndCohortId(c *gin.Co validAccessRequest := u.teamProjectAuthz.TeamProjectValidationForCohort(c, cohortId) if !validAccessRequest { log.Printf("Error: invalid request") - c.JSON(http.StatusBadRequest, gin.H{"message": "access denied"}) + c.JSON(http.StatusForbidden, gin.H{"message": "access denied"}) c.Abort() return } @@ -135,7 +135,7 @@ func (u ConceptController) RetrieveBreakdownStatsBySourceIdAndCohortIdAndVariabl validAccessRequest := u.teamProjectAuthz.TeamProjectValidation(c, []int{cohortId}, cohortPairs) if !validAccessRequest { log.Printf("Error: invalid request") - c.JSON(http.StatusBadRequest, gin.H{"message": "access denied"}) + c.JSON(http.StatusForbidden, gin.H{"message": "access denied"}) c.Abort() return } @@ -201,7 +201,7 @@ func (u ConceptController) RetrieveAttritionTable(c *gin.Context) { validAccessRequest := u.teamProjectAuthz.TeamProjectValidation(c, []int{cohortId}, cohortPairs) if !validAccessRequest { log.Printf("Error: invalid request") - c.JSON(http.StatusBadRequest, gin.H{"message": "access denied"}) + c.JSON(http.StatusForbidden, gin.H{"message": "access denied"}) c.Abort() return }