quality/testdays-web

Fork 0

Enable public access to draft events #133

Merged

jgroman merged 1 commit from feature/131-make-drafts-public into develop

2026-07-17 13:00:39 +00:00

jgroman commented

2026-07-15 12:00:55 +00:00

Owner

Make draft events visible to everyone

Remove permission check for draft events
Add test covering this usecase

Fixes #131

Assisted-by: Claude Code

Make draft events visible to everyone - Remove permission check for draft events - Add test covering this usecase Fixes #131 Assisted-by: Claude Code

jgroman self-assigned this

2026-07-15 12:00:55 +00:00

jgroman added 1 commit

2026-07-15 12:00:56 +00:00

Enable public access to draft events

Run tests / test (pull_request) Successful in 33s

Details

AI Code Review / ai-review (pull_request_target) Successful in 14s

Details

6554cb351b

- Remove permission check for draft events
- Add test covering this usecase

Fixes #131

Assisted-by: Claude Code

jgroman changed title from ~~WIP: Enable public access to draft events~~ to Enable public access to draft events

2026-07-15 12:18:13 +00:00

jgroman added the

ai-review-please

label

2026-07-15 12:18:19 +00:00

forgejo-actions removed the

ai-review-please

label

2026-07-15 12:18:21 +00:00

forgejo-actions commented

2026-07-15 12:18:31 +00:00

AI Code Review

📋 MR Summary

Enables public visibility of draft testday events by removing the permission checks for draft status in the index route.

Key Changes:
- Removed role-based query filtering for testdays in the index route.
- Draft testdays are now fetched and displayed alongside non-draft events for all users.
- Added a functional test to verify draft testdays are visible to anonymous users in the listing.
Impact: testdays/controllers/main.py, tests/functional/test_main.py
Risk Level: 🟡 Medium - Modifying visibility permissions to make drafts public changes expected behavior. While intended, this introduces the risk of inadvertently exposing sensitive/incomplete data before it is ready if the 'draft' status was previously used as a security measure rather than purely workflow.

Detailed Code Review

The changes successfully implement the objective described in the PR/commit messages (Fixes #131). By removing the conditional check in the index() route, all events are now fetched regardless of draft status or user permissions. However, ensure that exposing draft events does not leak sensitive information that should remain private during the drafting phase. The added test adequately covers the new behavior for anonymous users.

📂 File Reviews

📄 `testdays/controllers/main.py` - Removed query filtering that hid draft events from non-creator users.

Minor [Security]: Removing the draft visibility restriction makes all draft events visible to the public. Verify with the product/business requirements that draft events do not contain sensitive, unapproved information that should strictly remain private before publishing.

📄 `tests/functional/test_main.py` - Added a new functional test for the index page to verify draft visibility.

Minor [Testing]: The new test verifies that draft events are visible to anonymous users, which aligns with the PR goal. Ensure that existing tests asserting draft events were hidden from anonymous users (if any existed) have been updated or removed.

✅ Summary

Overall Assessment: The changes achieve the stated goal of making draft events public. No critical implementation issues were found, but the security implication of exposing drafts should be double-checked against business requirements.
Minor Suggestions:
- Confirm that making drafts public does not expose sensitive or unapproved data.
- Check if any existing tests that asserted drafts are hidden need to be removed or updated, to prevent CI failures.

🤖 AI Code Review | Generated with ai-code-review | Model: gemini-3.1-pro-preview

⚠️ AI-generated suggestions may be incorrect. Verify before applying. Not a replacement for human review.

## AI Code Review ### 📋 MR Summary Enables public visibility of draft testday events by removing the permission checks for draft status in the index route. - **Key Changes:** - Removed role-based query filtering for testdays in the index route. - Draft testdays are now fetched and displayed alongside non-draft events for all users. - Added a functional test to verify draft testdays are visible to anonymous users in the listing. - **Impact:** testdays/controllers/main.py, tests/functional/test_main.py - **Risk Level:** 🟡 Medium - Modifying visibility permissions to make drafts public changes expected behavior. While intended, this introduces the risk of inadvertently exposing sensitive/incomplete data before it is ready if the 'draft' status was previously used as a security measure rather than purely workflow. ### Detailed Code Review The changes successfully implement the objective described in the PR/commit messages (Fixes #131). By removing the conditional check in the `index()` route, all events are now fetched regardless of draft status or user permissions. However, ensure that exposing draft events does not leak sensitive information that should remain private during the drafting phase. The added test adequately covers the new behavior for anonymous users. #### 📂 File Reviews <details> <summary><strong>📄 `testdays/controllers/main.py`</strong> - Removed query filtering that hid draft events from non-creator users.</summary> - **Minor** [Security]: Removing the draft visibility restriction makes all draft events visible to the public. Verify with the product/business requirements that draft events do not contain sensitive, unapproved information that should strictly remain private before publishing. </details> <details> <summary><strong>📄 `tests/functional/test_main.py`</strong> - Added a new functional test for the index page to verify draft visibility.</summary> - **Minor** [Testing]: The new test verifies that draft events are visible to anonymous users, which aligns with the PR goal. Ensure that existing tests asserting draft events were *hidden* from anonymous users (if any existed) have been updated or removed. </details> ### ✅ Summary - **Overall Assessment:** The changes achieve the stated goal of making draft events public. No critical implementation issues were found, but the security implication of exposing drafts should be double-checked against business requirements. - **Minor Suggestions:** - Confirm that making drafts public does not expose sensitive or unapproved data. - Check if any existing tests that asserted drafts are hidden need to be removed or updated, to prevent CI failures. --- 🤖 **AI Code Review** | Generated with [ai-code-review](https://gitlab.com/redhat/edge/ci-cd/ai-code-review) | **Model:** `gemini-3.1-pro-preview` ⚠️ *AI-generated suggestions may be incorrect. Verify before applying. Not a replacement for human review.*

jgroman changed title from ~~Enable public access to draft events~~ to WIP: Enable public access to draft events

2026-07-15 12:23:45 +00:00

jgroman changed title from ~~WIP: Enable public access to draft events~~ to Enable public access to draft events

2026-07-16 11:55:10 +00:00

jgroman requested review from kparal

2026-07-16 11:55:54 +00:00

jgroman commented

2026-07-16 12:04:56 +00:00

Author

Owner

Ready for review

jgroman added a new dependency