fix: only return events that are owned by the user

uktrade · Nov 21, 2023 · 8b07a10 · 8b07a10
1 parent e94794b
commit 8b07a10
Show file tree

Hide file tree

Showing 2 changed files with 19 additions and 7 deletions.
diff --git a/dataworkspace/dataworkspace/apps/api_v2/recent_items/views.py b/dataworkspace/dataworkspace/apps/api_v2/recent_items/views.py
@@ -22,4 +22,8 @@ class RecentItemsViewSet(TimestampFilterMixin, viewsets.ModelViewSet):
     permission_classes = [IsAuthenticated]
 
     def get_queryset(self):
-        return super().get_queryset().filter(event_type=EventLog.TYPE_DATASET_VIEW)
+        return (
+            super()
+            .get_queryset()
+            .filter(user=self.request.user, event_type=EventLog.TYPE_DATASET_VIEW)
+        )
diff --git a/dataworkspace/dataworkspace/tests/api_v2/recent_items/test_recent_items.py b/dataworkspace/dataworkspace/tests/api_v2/recent_items/test_recent_items.py
@@ -15,27 +15,35 @@ def test_unauthenticated_recent_items(unauthenticated_client):
 @pytest.mark.django_db
 def test_ordering_and_filtering_recent_items(client, user):
     client.force_login(user)
-    event1 = factories.EventLogFactory(
+    user_event1 = factories.EventLogFactory(
+        user=user,
         event_type=EventLog.TYPE_DATASET_VIEW,
         related_object=factories.ReferenceDatasetFactory.create(),
     )
-    event2 = factories.EventLogFactory(
+    user_event2 = factories.EventLogFactory(
+        user=user,
         event_type=EventLog.TYPE_DATASET_VIEW,
         related_object=factories.ReferenceDatasetFactory.create(),
     )
-    event3 = factories.EventLogFactory(
+    user_event3 = factories.EventLogFactory(
+        user=user,
         event_type=EventLog.TYPE_DATASET_VIEW,
         related_object=factories.ReferenceDatasetFactory.create(),
     )
     factories.EventLogFactory(
+        event_type=EventLog.TYPE_DATASET_VIEW,
+        related_object=factories.ReferenceDatasetFactory.create(),
+    )
+    factories.EventLogFactory(
+        user=user,
         event_type=EventLog.TYPE_DATASET_FIND_FORM_QUERY,
         related_object=factories.ReferenceDatasetFactory.create(),
     )
 
     response = client.get(reverse("api-v2:recent_items:eventlog-list"))
     recent_items = response.json()
     assert len(recent_items["results"]) == 3
-    assert recent_items["results"][0]["id"] == event3.id
-    assert recent_items["results"][1]["id"] == event2.id
-    assert recent_items["results"][2]["id"] == event1.id
+    assert recent_items["results"][0]["id"] == user_event3.id
+    assert recent_items["results"][1]["id"] == user_event2.id
+    assert recent_items["results"][2]["id"] == user_event1.id
     assert response.status_code == status.HTTP_200_OK