[FIX] status api: make a minimalist working version of route: api/nodes/42/status

gargantext/views/api/nodes.py

@@ -149,17 +149,27 @@ class Status(APIView):
             return HttpResponse('Unauthorized', status=401)
 
         user = cache.User[request.user.id]
-        check_rights(request, node_id)
+        # check_rights(request, node_id)
+        # I commented check_rights because filter on user_id below does the job
+
         node = session.query(Node).filter(Node.id == node_id, Node.user_id== user.id).first()
         if node is None:
             return Response({"detail":"Node not Found for this user"}, status=HTTP_404_NOT_FOUND)
         else:
-            context = format_response(node, [n for n in node.children()])
+
+            # FIXME using the more generic strategy ---------------------------
+            # context = format_response(node, [n for n in node.children()])
+            # or perhaps ? context = format_response(None, [node])
+            # -----------------------------------------------------------------
+
+            # using a more direct strategy
+            context = {}
             try:
-                context["status"] = node.hyperdata["statuses"]
+               context["statuses"] = node.hyperdata["statuses"]
             except KeyError:
-                context["status"] = None
+               context["statuses"] = None
             return Response(context)
+
     def post(self, request, data):
         '''create a new status for node'''
         if not request.user.is_authenticated():
@@ -176,8 +186,8 @@ class Status(APIView):
             return HttpResponse('Unauthorized', status=401)
 
         user = cache.User[request.user.id]
-        check_rights(request, node_id)
-        node = session.query(Node).filter(Node.id == node_id).first()
+        # check_rights(request, node_id)
+        node = session.query(Node).filter(Node.id == node_id, Node.user_id== user.id).first()
 
         raise NotImplementedError
 
@@ -191,8 +201,8 @@ class Status(APIView):
             return HttpResponse('Unauthorized', status=401)
 
         user = cache.User[request.user.id]
-        check_rights(request, node_id)
-        node = session.query(Node).filter(Node.id == node_id).first()
+        # check_rights(request, node_id)
+        node = session.query(Node).filter(Node.id == node_id, Node.user_id == user.id).first()
         if node is None:
             return Response({"detail":"Node not Found"}, status=HTTP_404_NOT_FOUND)
         node.hyperdata["status"] = []