Test: GET on a specific public dataview always returns 200.

- A GET request for *all* dataviews for unauthenticated users returns a 404.
- A GET request for *all* dataviews for authenticated users checks whether they
have the required permissions.
- A GET request for *a specific* public dataview *always* returns a 200.
- A GET request for *a specific* private dataview from unauthenticated users should
return a 404 but from authenticated users should check whether they have the
required permissions.

Signed-off-by: Njagi Mwaniki <[email protected]>

onadata/apps/api/permissions.py

@@ -236,10 +236,10 @@ class DataViewViewsetPermissions(AlternateHasObjectPermissionMixin,
     model_classes = [Project]
 
     def has_permission(self, request, view):
-        if request.user.is_anonymous() and view.action == 'list':
-            return False
-        else:
-            return True
+        # To allow individual public dataviews to be visible on
+        # `api/v1/dataviews/<pk>` but stop retreival of all dataviews when
+        # the dataviews endpoint is queried `api/v1/dataviews`
+        return not (request.user.is_anonymous() and view.action == 'list')
 
     def has_object_permission(self, request, view, obj):
         model_cls = Project

onadata/apps/api/tests/viewsets/test_dataview_viewset.py

@@ -156,6 +156,22 @@ def test_get_dataview(self):
         self.assertEquals(response.data['last_submission_time'],
                           '2015-03-09T13:34:05')
 
+        # Public
+        self.project.shared = True
+        self.project.save()
+
+        anon_request = self.factory.get('/')
+        anon_response = self.view(anon_request, pk=self.data_view.pk)
+        self.assertEquals(anon_response.status_code, 200)
+
+        # Private
+        self.project.shared = False
+        self.project.save()
+
+        anon_request = self.factory.get('/')
+        anon_response = self.view(anon_request, pk=self.data_view.pk)
+        self.assertEquals(anon_response.status_code, 404)
+
     def test_update_dataview(self):
         self._create_dataview()
 
@@ -252,6 +268,10 @@ def test_list_dataview(self):
         self.assertEquals(response.status_code, 200)
         self.assertEquals(len(response.data), 2)
 
+        anon_request = request = self.factory.get('/')
+        anon_response = view(anon_request)
+        self.assertEquals(anon_response.status_code, 401)
+
     def test_get_dataview_no_perms(self):
         self._create_dataview()