Improve access denial messages for task assignments - #5437
Open
ajrbyers wants to merge 1 commit into
Open
Conversation
… Denied Task links opened with the wrong account signed in gave no clue what was wrong. Each denial now names the account making the request and what it would take to get in, without ever naming the account a task belongs to. Assignment lookups are scoped to the account and the journal in the URL, so a task belonging to somebody else, one on another journal and one that does not exist are answered identically and cannot be told apart. Staff no longer pass reviewer_user_for_assignment_required. The views behind it fetch the assignment again filtered by reviewer=request.user, so admitting staff only moved the failure into the view, where it was reported as the review not belonging to them. Staff read reviews through the editor pages. Two tests that asserted the old behaviour are updated.
ajrbyers
force-pushed
the
b-2970-permission-denied-messages-1.9
branch
from
August 14, 2026 14:23
a1a91b5 to
2a3e266
Compare
mauromsl
requested changes
Aug 20, 2026
mauromsl
left a comment
mauromsl
left a comment
Member
There was a problem hiding this comment.
I like the new error messages and will improve useability when facing these 403 screens.
Added a couple minor comments inline regarding the changes to the security checks. In general I prefer the default return on these to be deny_access and the conditional logic to be the allow flag, somehow it gives me higher confidence even though all you've done is apply de morgan's law, so they should be equivalent :D
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #2970
Adds options for decorators to pass messages to deny_access. Most security decorators now determine a reason for the user being denied access in such a way that they do not leak whether the assignment exists or not when that particular user isnt the owner of the task.