{"action":"created","issue":{"url":"https://api.github.com/repos/inveniosoftware/invenio-files-rest/issues/96","repository_url":"https://api.github.com/repos/inveniosoftware/invenio-files-rest","labels_url":"https://api.github.com/repos/inveniosoftware/invenio-files-rest/issues/96/labels{/name}","comments_url":"https://api.github.com/repos/inveniosoftware/invenio-files-rest/issues/96/comments","events_url":"https://api.github.com/repos/inveniosoftware/invenio-files-rest/issues/96/events","html_url":"https://github.com/inveniosoftware/invenio-files-rest/issues/96","id":169805274,"number":96,"title":"api: inconsistent error codes in REST API","user":{"login":"nharraud","id":5708796,"avatar_url":"https://avatars.githubusercontent.com/u/5708796?v=3","gravatar_id":"","url":"https://api.github.com/users/nharraud","html_url":"https://github.com/nharraud","followers_url":"https://api.github.com/users/nharraud/followers","following_url":"https://api.github.com/users/nharraud/following{/other_user}","gists_url":"https://api.github.com/users/nharraud/gists{/gist_id}","starred_url":"https://api.github.com/users/nharraud/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nharraud/subscriptions","organizations_url":"https://api.github.com/users/nharraud/orgs","repos_url":"https://api.github.com/users/nharraud/repos","events_url":"https://api.github.com/users/nharraud/events{/privacy}","received_events_url":"https://api.github.com/users/nharraud/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/inveniosoftware/invenio-files-rest/labels/Lane:%20fast","name":"Lane: fast","color":"ffa868"},{"url":"https://api.github.com/repos/inveniosoftware/invenio-files-rest/labels/Need:%20information","name":"Need: information","color":"719caa"},{"url":"https://api.github.com/repos/inveniosoftware/invenio-files-rest/labels/Size:%20hard","name":"Size: hard","color":"a828a8"},{"url":"https://api.github.com/repos/inveniosoftware/invenio-files-rest/labels/Type:%20bug","name":"Type: bug","color":"ff2a00"},{"url":"https://api.github.com/repos/inveniosoftware/invenio-files-rest/labels/Type:%20discussion","name":"Type: discussion","color":"ffaa00"}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/inveniosoftware/invenio-files-rest/milestones/6","html_url":"https://github.com/inveniosoftware/invenio-files-rest/milestones/I3B-API-Docs","labels_url":"https://api.github.com/repos/inveniosoftware/invenio-files-rest/milestones/6/labels","id":1889026,"number":6,"title":"I3B-API-Docs","description":"","creator":{"login":"tiborsimko","id":517546,"avatar_url":"https://avatars.githubusercontent.com/u/517546?v=3","gravatar_id":"","url":"https://api.github.com/users/tiborsimko","html_url":"https://github.com/tiborsimko","followers_url":"https://api.github.com/users/tiborsimko/followers","following_url":"https://api.github.com/users/tiborsimko/following{/other_user}","gists_url":"https://api.github.com/users/tiborsimko/gists{/gist_id}","starred_url":"https://api.github.com/users/tiborsimko/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tiborsimko/subscriptions","organizations_url":"https://api.github.com/users/tiborsimko/orgs","repos_url":"https://api.github.com/users/tiborsimko/repos","events_url":"https://api.github.com/users/tiborsimko/events{/privacy}","received_events_url":"https://api.github.com/users/tiborsimko/received_events","type":"User","site_admin":false},"open_issues":3,"closed_issues":0,"state":"open","created_at":"2016-07-18T09:42:14Z","updated_at":"2016-08-07T16:55:55Z","due_on":null,"closed_at":null},"comments":6,"created_at":"2016-08-07T16:55:54Z","updated_at":"2016-08-08T09:39:19Z","closed_at":null,"body":"**Problem:**\r\nWhen trying to call `ObjectResource.put` in the REST API, if the user does not have access the status code will always be 404 whereas it should be 401 or 403 when the user has read access on the object (`GET` returns 200).\r\n\r\nI didn't check every REST API method but I suspect it might not be the only one with this issue.\r\n\r\nI mark this as *hard* as it requires some refactoring.\r\n\r\nThis impacts inveniosoftware/invenio-files-rest#89"},"comment":{"url":"https://api.github.com/repos/inveniosoftware/invenio-files-rest/issues/comments/238188422","html_url":"https://github.com/inveniosoftware/invenio-files-rest/issues/96#issuecomment-238188422","issue_url":"https://api.github.com/repos/inveniosoftware/invenio-files-rest/issues/96","id":238188422,"user":{"login":"lnielsen","id":1698163,"avatar_url":"https://avatars.githubusercontent.com/u/1698163?v=3","gravatar_id":"","url":"https://api.github.com/users/lnielsen","html_url":"https://github.com/lnielsen","followers_url":"https://api.github.com/users/lnielsen/followers","following_url":"https://api.github.com/users/lnielsen/following{/other_user}","gists_url":"https://api.github.com/users/lnielsen/gists{/gist_id}","starred_url":"https://api.github.com/users/lnielsen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lnielsen/subscriptions","organizations_url":"https://api.github.com/users/lnielsen/orgs","repos_url":"https://api.github.com/users/lnielsen/repos","events_url":"https://api.github.com/users/lnielsen/events{/privacy}","received_events_url":"https://api.github.com/users/lnielsen/received_events","type":"User","site_admin":false},"created_at":"2016-08-08T09:39:19Z","updated_at":"2016-08-08T09:39:19Z","body":"> They can't make the difference between a file or a bucket which has just been deleted and a file which they don't have access to\r\n\r\nBut that's kind of the point - if you don't have access, you shouldn't even know that it exists.\r\n\r\nIs it possible to workaround it from the client side by simply:\r\n\r\n- List objects ``GET /api/files/:bucket``. (200, i.e. has read permissions)\r\n- Put object ``PUT /api/files/:bucket/:key`` (404, i.e. don't have update permissions)\r\n\r\nand:\r\n\r\n- List objects ``GET /api/files/:bucket``. (404, i.e. don't have read permissions)\r\n\r\n"}}
{"actor":{"display_login":"lnielsen"}}