Skip to content

ListProcesses can list processes that you do not actually have access to

  1. As a corpus admin, create a process.
  2. Leave the corpus entirely.
  3. List your processes with ?created=true to find the processes that you created.
  4. The process is still included even though you do not have access to its corpus.
  5. Cry.

This is due to a legacy of having special access rights granted to process creators, even when they do not have access to the process' corpus, because Repository processes did not have a corpus assigned. Nowadays, the only processes without corpora are Local processes, which are not meant to be ever accessed by users in any way other than the UserWorkerRun APIs.

ListProcess is the only API endpoint that still has this specificity, as it is the only one still using ProcessACLMixin.readable_processes. We can remove this property to remove a little bit of the deprecated ACLMixins, and replace this with a new Process.objects.filter(corpus__in=Corpus.objects.readable(…)).