Merge pull request #77 from TheJacksonLaboratory/G3-252-api-geneset-v…

…alue-access

G3-252 api geneset value access correction

pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "geneweaver-api"
-version = "0.7.0a5"
+version = "0.7.0a6"
 description = "The Geneweaver API"
 authors = [
     "Alexander Berger <[email protected]>",

src/geneweaver/api/controller/genesets.py

@@ -173,7 +173,9 @@ def get_geneset_values(
             raise HTTPException(status_code=500, detail=api_message.UNEXPECTED_ERROR)
 
     if response.get("data") is None:
-        raise HTTPException(status_code=404, detail=api_message.RECORD_NOT_FOUND_ERROR)
+        raise HTTPException(
+            status_code=404, detail=api_message.INACCESSIBLE_OR_FORBIDDEN
+        )
 
     return response
 

src/geneweaver/api/controller/message.py

@@ -2,7 +2,7 @@
 
 ##Errors
 ACCESS_FORBIDDEN = "Forbidden"
-INACCESSIBLE_OR_FORBIDDEN = "Record not found or forbidden"
+INACCESSIBLE_OR_FORBIDDEN = "Record not found or forbidden access"
 UNEXPECTED_ERROR = "Unexpected Error"
 GENE_IDENTIFIER_TYPE_VALUE_ERROR = "Invalid gene identifier type"
 RECORD_NOT_FOUND_ERROR = "Record not found"

src/geneweaver/api/services/geneset.py

@@ -191,6 +191,9 @@ def get_geneset(
             gs_id=geneset_id,
             with_publication_info=False,
         )
+        if len(results) <= 0:
+            return {"data": None}
+
         geneset = results[0]
         geneset_values = db_geneset_value.by_geneset_id(
             cursor=cursor, geneset_id=geneset_id, gsv_in_threshold=in_threshold
@@ -223,17 +226,19 @@ def get_geneset_gene_values(
         if user is None or user.id is None:
             return {"error": True, "message": message.ACCESS_FORBIDDEN}
 
+        ## Check genset exists and user can read it
+        results = db_geneset.get(
+            cursor,
+            gs_id=geneset_id,
+            is_readable_by=user.id,
+            with_publication_info=False,
+        )
+        if len(results) <= 0:
+            return {"data": None}
+
         # If gene id type is given, check gene species homology to
         # construct proper gene species mapping
         if gene_id_type is not None:
-            results = db_geneset.get(
-                cursor,
-                gs_id=geneset_id,
-                with_publication_info=False,
-            )
-            if len(results) <= 0:
-                return {"data": None}
-
             geneset = results[0]
             geneset_values = get_gsv_w_gene_homology_update(
                 cursor=cursor,

tests/services/test_genset.py

@@ -32,12 +32,17 @@ def test_get_geneset(mock_db_geneset, mock_db_genset_value):
     assert response.get("error") is None
 
 
-def test_get_geneset_no_user_access():
+@patch("geneweaver.api.services.geneset.db_geneset")
+def test_get_geneset_no_user_access(mock_db_geneset):
     """Test get geneset by ID with no user access."""
     response = geneset.get_geneset(None, 1234, None)
     assert response.get("error") is True
     assert response.get("message") == message.ACCESS_FORBIDDEN
 
+    mock_db_geneset.get.return_value = []
+    response = geneset.get_geneset(None, 1234, mock_user)
+    assert response.get("data") is None
+
 
 @patch("geneweaver.api.services.geneset.db_geneset")
 @patch("geneweaver.api.services.geneset.db_geneset_value")
@@ -296,8 +301,10 @@ def test_map_geneset_homology_db_call_error(mock_db_gene):
 
 
 @patch("geneweaver.api.services.geneset.db_geneset_value")
-def test_geneset_gene_value_response(mock_db_geneset_value):
+@patch("geneweaver.api.services.geneset.db_geneset")
+def test_geneset_gene_value_response(mock_db_geneset, mock_db_geneset_value):
     """Test geneset gene value data response."""
+    mock_db_geneset.get.return_value = [geneset_by_id_resp.get("geneset")]
     mock_db_geneset_value.by_geneset_id.return_value = geneset_by_id_resp.get(
         "geneset_values"
     )