feat(GAT-1111): add ProjectGrant create endpoint#1695
Conversation
Keep DatasetSeeder and DatasetVersionSeeder unchanged for default HDRUK seeding; add CRUKDatasetSeeder and CRUKDatasetVersionSeeder for optional CRUK fixture data.
Adds POST /api/v1/project_grants with request validation and a feature test.
|
🚨 Invalid PR title format! Your PR title must follow one of these formats:
Please update your PR title accordingly. 😊 |
| $input = $request->validated(); | ||
|
|
||
| $grant = ProjectGrant::create([ | ||
| 'pid' => $input['pid'], |
There was a problem hiding this comment.
If these are meant to be unique, might it be worth checking?
There was a problem hiding this comment.
I too question this. For object creation I'd imagine that this would be generated in real-time via UUID or something similar, but this appears to come from the client, is that correct? Does the client create unique pids?
There was a problem hiding this comment.
Looking at the dataset metadata structure (e.g. dataset_00.json), a project grant is supplied as an object where pid is the grant ID:
"projectGrants": [
{
"pid": "ORT105",
"projectGrantName": "Pancreatic Cancer Radiomics Integration",
"leadResearcher": "Dr. Miller",
...
}
]
So pid (e.g. "ORT105") is the grant identifier and is part of the project grant object the client supplies on create — not something we generate separately. Sarah supplied something like CRCXX-XXXXXXXXX.
| 'path' => '/project_grants', | ||
| 'methodController' => 'ProjectGrantController@store', | ||
| 'namespaceController' => 'App\Http\Controllers\Api\V1', | ||
| 'middleware' => [], |
There was a problem hiding this comment.
Must add the correct middleware. At least 'jwt.verify' but we probably also want to add in specific permissions for projectgrant.create etc into the permissions model. That is likely a bigger piece of work though,
| { | ||
| try { | ||
| $input = $request->validated(); | ||
|
|
There was a problem hiding this comment.
Please ensure you use the getAccessorUserAndTeam trait to standardise and validate the input payload, and then use checkAccess to control access.
TBH we need to agree the ownership model for ProjectGrants - are they owned by Teams, by Users, or by either? See also later comment about permissions model needing to be extended in light of that.
There was a problem hiding this comment.
Fixed. They are owned by the Teams .
cocoon02
changed the title
|
🎉 Great job! Your PR title follows the correct format. 🚀 |
| ]); | ||
| } | ||
|
|
||
| public function test_store_creates_project_grant_with_version_and_dataset_links(): void |
There was a problem hiding this comment.
Once the middleware for jwt.verify has been included above, per Sam's comment, this test will fail and will need addressing.
- Require jwt.verify and check.access:permissions,project_grants.create on POST /project_grants - Add project_grants.* permissions to seeders and a migration for existing databases - Resolve acting user/team via getAccessorUserAndTeam and enforce team access with checkAccess - Validate pid uniqueness on create; extend feature tests for auth and permission paths
3 participants
Summary
Adds POST /api/v1/project_grants to create a ProjectGrant plus initial version.
Adds request validation via CreateProjectGrant.
Adds feature coverage for creating a grant (incl. version + dataset link).
Test plan
php artisan test --filter ProjectGrantTest