<commit_before>require 'barby'
require 'barby/barcode/qr_code'
require 'barby/outputter/svg_outputter'
require 'digest'

module Chemotion
  class AttachmentAPI < Grape::API

    rescue_from ActiveRecord::RecordNotFound do |error|
      message = "Could not find attachment"
      error!(message, 404)
    end

    resource :inbox do
      get do
        if current_user
          if !current_user.container
            current_user.container = Container.create(name: "inbox", container_type: "root")
          end
          unlinked_attachments = Attachment.where(:container_id => nil, :created_for => current_user.id)
          InboxSerializer.new(current_user.container)
        end
      end
    end

    resource :attachments do
      before do
        case request.env['REQUEST_METHOD']
        when /delete/i
          if @attachment = Attachment.find(params[:attachment_id])
            if element = @attachment.container && @attachment.container.root.containable
              can_delete = ElementPolicy.new(current_user, element).update?
            else
              can_delete = @attachment.created_for == current_user.id
            end
            error!('401 Unauthorized', 401) unless can_delete
          end
        when /post/i

        when /get/i
          if request.url.match(/zip/)
            @container = Container.find(params[:container_id])
            if element = container.root.containable
              can_read = ElementPolicy.new(current_user, element).read?
              can_dwnld = can_read && ElementPermissionProxy.new(current_user, element, user_ids).read_dataset?
            end
            error!('401 Unauthorized', 401) unless can_dwnld
          elsif @attachment = Attachment.find(params[:attachment_id])
             element = @attachment.container.root.containable
             can_read = ElementPolicy.new(current_user, element).read?
             can_dwnld = can_read && ElementPermissionProxy.new(current_user, element, user_ids).read_dataset?
             error!('401 Unauthorized', 401) unless can_dwnld
          end
        end
      end

      desc "Delete Attachment"
      delete ':attachment_id' do
        @attachment.delete
      end

      desc "Delete container id of attachment"
      delete 'link/:attachment_id' do
        @attachment.container_id = nil
        @attachment.save!
      end
<commit_msg>fix permission for attachment api<commit_after>require 'barby'
require 'barby/barcode/qr_code'
require 'barby/outputter/svg_outputter'
require 'digest'

module Chemotion
  class AttachmentAPI < Grape::API

    rescue_from ActiveRecord::RecordNotFound do |error|
      message = "Could not find attachment"
      error!(message, 404)
    end

    resource :inbox do
      get do
        if current_user
          if !current_user.container
            current_user.container = Container.create(name: "inbox", container_type: "root")
          end
          # unlinked_attachments = Attachment.where(container_id: nil, created_for: current_user.id)
          InboxSerializer.new(current_user.container)
        end
      end
    end

    resource :attachments do
      before do
        @attachment = Attachment.find_by(id: params[:attachment_id])
        case request.env['REQUEST_METHOD']
        when /delete/i
          error!('401 Unauthorized', 401) unless @attachment
          can_delete = @attachment.container_id.nil? && @attachment.created_for == current_user.id
          if !can_delete && (element = @attachment.container&.root&.containable)
            can_delete = element.is_a?(User) && (element == current_user) ||
                         ElementPolicy.new(current_user, element).update?
          end
          error!('401 Unauthorized', 401) unless can_delete
        # when /post/i
        when /get/i
          can_dwnld = false
          if request.url =~ /zip/
            @container = Container.find(params[:container_id])
            if (element = container.root.containable)
              can_read = ElementPolicy.new(current_user, element).read?
              can_dwnld = can_read &&
                          ElementPermissionProxy.new(current_user, element, user_ids).read_dataset?
            end
          elsif @attachment
            can_dwnld = @attachment.container_id.nil? && @attachment.created_for == current_user.id
            if !can_dwnld && (element = @attachment.container&.root&.containable)
              can_dwnld = element.is_a?(User) && (element == current_user) ||
                          ElementPolicy.new(current_user, element).read? &&
                          ElementPermissionProxy.new(current_user, element, user_ids).read_dataset?
            end
          end
          error!('401 Unauthorized', 401) unless can_dwnld
        end
      end

      desc "Delete Attachment"
      delete ':attachment_id' do
        @attachment.delete
      end

      desc "Delete container id of attachment"
      delete 'link/:attachment_id' do
        @attachment.container_id = nil
        @attachment.save!
      end

{'fraction_non_alphanumeric': 0.08980727200476853, 'fraction_numerical': 0.008344923504867872, 'mean_word_length': 2.2966601178781927, 'pattern_counts': {'":': 0, '<': 5, '<?xml version=': 0, '>': 5, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '2996620', 'n_tokens_mistral': 1410, 'n_tokens_neox': 1359, 'n_words': 308}