TT#122001 Allow subscribers to access /api/subscriberprofiles

* subscribers are now allowed to fetch their own
	    subscriber profile, they can't modify them

Change-Id: Iabf1244020d0f453257993cf24d4c9036a125397
mr9.5.1
Flaviu Mates 4 years ago
parent 69e7373f2d
commit 35d9c3598a

@ -60,7 +60,10 @@ sub relation{
}
__PACKAGE__->set_config({
allowed_roles => [qw/admin reseller ccareadmin ccare/],
allowed_roles => {
'Default' => [qw/admin reseller ccareadmin ccare/],
'GET' => [qw/admin reseller ccareadmin ccare subscriberadmin subscriber/],
},
});
sub GET :Allow {

@ -38,6 +38,7 @@ __PACKAGE__->set_config({
allowed_roles => {
Default => [qw/admin reseller ccareadmin ccare/],
Journal => [qw/admin reseller ccareadmin ccare/],
'GET' => [qw/admin reseller ccareadmin ccare subscriberadmin subscriber/],
}
});

@ -20,6 +20,8 @@ sub _item_rs {
$item_rs = $item_rs->search({ 'profile_set.reseller_id' => $c->user->reseller_id }, {
join => 'profile_set',
});
} elsif ($c->user->roles eq "subscriber" || $c->user->roles eq "subscriberadmin") {
$item_rs = $item_rs->search({ id => $c->user->profile_id });
}
return $item_rs;
}

Loading…
Cancel
Save