Notifications: not showing due to permissions issues (.com)

[diego-sueiro]

As seen below I have both options enabled:

But when browsing an old version, no warnings are displayed.

Documentation URL: https://arm-auto-solutions.docs.arm.com/

[humitos]

Hrm, it seems the API is not returning all the required data: build.curent: null.

I found that by going https://arm-auto-solutions.docs.arm.com/en/v1.1/?logging=debug and checking the web developer Console. There is a data validation error.

This seems to be a permissions issue on the Build object.

Thanks for reporting this, we will take a deeper look and define how to fix it.

[humitos]

This seems to be a permissions issue on the Build object.

We are performing the query for the Build object at

https://github.com/readthedocs/readthedocs.org/blob/73a5fcee7b75a3d8ece7227ed26068cc4548b83b/readthedocs/proxito/views/hosting.py#L149-L159

which uses this underlying code behind the scenes

https://github.com/readthedocs/readthedocs.org/blob/73a5fcee7b75a3d8ece7227ed26068cc4548b83b/readthedocs/builds/querysets.py#L176-L211

I found that build.current is not being returned in the API response because both, the Version and the Project privacy level has to be public. @diego-sueiro In your case, the Version privacy level is public, but the Project one is not. If you change the privacy level of your project to public it should show the notification.

@ericholscher @stsewd does this behavior make sense? should we consider builds public if the version attached to that build is public?

[diego-sueiro]

I found that build.current is not being returned in the API response because both, the Version and the Project privacy level has to be public. @diego-sueiro In your case, the Version privacy level is public, but the Project one is not. If you change the privacy level of your project to public it should show the notification.

@humitos, thanks for investigating this.

Unfortunately, we don't want to have the project dashboard publicly available.

[stsewd]

does this behavior make sense? should we consider builds public if the version attached to that build is public?

Project privacy controls if users can see the dashboard, the build detail page is part of that https://docs.readthedocs.com/platform/stable/commercial/privacy-level.html#project-privacy. Addons should take that into consideration and not use the build for nominations that don't needed, or don't link to the build when the user doesn't have access to it. Another way would also for the API to just return the identifier of the build, and not the whole object if isn't needed, so we still generate a link, but the user can access the full build only if they have permissions from the dashboard.