[TM-1492] make dashboard endpoints publicly accessible (#577)

wri · Nov 19, 2024 · 3b75b5a · 3b75b5a
1 parent a88366b
commit 3b75b5a
Show file tree

Hide file tree

Showing 3 changed files with 8 additions and 8 deletions.
diff --git a/app/Http/Controllers/V2/Dashboard/GetProjectsController.php b/app/Http/Controllers/V2/Dashboard/GetProjectsController.php
@@ -14,7 +14,10 @@ public function __invoke(Request $request)
     {
         /** @var User $user */
         $user = Auth::user();
-        if ($user->hasRole('government') && data_get($request, 'filter.projectUuid', '')) {
+
+        if (is_null($user)) {
+            $request = new Request(['filter' => []]);
+        } elseif ($user->hasRole('government') && data_get($request, 'filter.projectUuid', '')) {
             $request = new Request(['filter' => []]);
         } else {
             $frameworks = data_get($request, 'filter.programmes', []);

diff --git a/app/Http/Controllers/V2/Dashboard/ViewProjectController.php b/app/Http/Controllers/V2/Dashboard/ViewProjectController.php
@@ -18,16 +18,13 @@ public function getIfUserIsAllowedToProject(String $uuid)
     {
         /** @var User $user */
         $user = Auth::user();
-        if ($user->hasRole('government')) {
+        if (is_null($user)) {
             $response = (object)[
               'allowed' => false,
             ];
-        } elseif ($user->hasRole('funder')) {
-            $isAllowed = Project::where('uuid', $uuid)
-                ->where('framework_key', $user->program)
-                ->exists();
+        } elseif ($user->hasRole('government') || $user->hasRole('funder')) {
             $response = (object)[
-                'allowed' => $isAllowed,
+              'allowed' => true,
             ];
         } elseif ($user->hasRole('project-developer')) {
             $projectId = Project::where('uuid', $uuid)

diff --git a/routes/api_v2.php b/routes/api_v2.php
@@ -722,7 +722,7 @@ function () {
     Route::delete('/{auditable}/{uuid}/delete', DeleteAuditStatusController::class);
 });
 
-Route::prefix('dashboard')->group(function () {
+Route::prefix('dashboard')->withoutMiddleware('auth:service-api-key,api')->group(function () {
     Route::get('/restoration-strategy', ViewRestorationStrategyController::class);
     Route::get('/jobs-created', GetJobsCreatedController::class);
     Route::get('/volunteers-survival-rate', VolunteersAndAverageSurvivalRateController::class);