Summary

This feature adds an ACL check to DatastoreService#readProtectedIn when there is no namespace protection. The following endpoints can be used to test the feature:

• GET /api/dataStore/{namespace}/{key}
• GET /api/dataStore/{namespace}/{key}/metaData

Background

There was already an existing read Sharing check performed for namespace entries that had namespace protection.
The read check has been updated to incorporate scenarios where there is no namespace protection in place (namespace protection is only setup programmatically currently. All namespaces setup through the API will not have any namespace protection).

DatastoreEntry Read criteria when no namespace protection

• Superuser can always read
• Any user can read by default (no Sharing changes made)
• Public access removed & User is not the owner
  • User cannot access
  • User can access when User added to Shared Users
  • User can access when User UserGroup added to Shared UserGroups

Testing

Automated

• Multiple e2e tests added to cover different scenarios

Manual

To manually test this feature, the following endpoints can be used:

• GET /api/dataStore/{namespace}/{key}
• GET /api/dataStore/{namespace}/{key}/metaData

To add an entry to a new namespace:

POST /api/dataStore/{myNamespace}/{myKey} with sample body

{
    "name": "test",
    "project": "dhis2"
}

To get the ID of a DataEntry use:
GET /api/dataStore/{namespace}/{key}/metaData

To remove public access of a DataEntry:

POST /api/sharing?type=dataStore&id={dataStoreEntryId} with body

{
    "object": {
        "publicAccess": "--------",
        "externalAccess": false,
        "user": {},
        "userAccesses": [],
        "userGroupAccesses": []
    }
}

To share access of a DataEntry with another User & remove public access:

POST /api/sharing?type=dataStore&id={dataStoreEntryId} with body

{
    "object": {
        "publicAccess": "--------",
        "externalAccess": false,
        "user": {},
        "userAccesses": [
            {
                "id": "{userId}",
                "access": "r-------"
            }
        ],
        "userGroupAccesses": []
    }
}

To share access with a UserGroup & remove public access use:

{
    "object": {
        "publicAccess": "--------",
        "externalAccess": false,
        "user": {},
        "userAccesses": [],
        "userGroupAccesses": [
            {
                "id": "{userGroupId}",
                "access": "r-------"
            }
        ]
    }
}