NotAuthorized Error about ckanext-extractor

[torfsen]

Thanks for your report, @gjackson12! What versions of CKAN and ckanext-extractor are you running, and can you please provide a full traceback?

[gjackson12]

Hi @torfsen ! I am using CKAN v 2.7.2 and ckanext-exractor (master branch).

The full traceback:

2017-11-21 01:40:47,096: INFO/MainProcess] Connected to postgresql://ckan_default:ckan@gjackson-ckan-postgres:5432/ckan_default
[2017-11-21 01:40:47,263: WARNING/MainProcess] celery@3b540691f9b3 ready.
[2017-11-21 01:44:24,165: INFO/MainProcess] Received task: extractor.extract[8aa6ec9e-f368-4d05-8587-6b7d3b6a07d6]
[2017-11-21 01:44:26,805: ERROR/MainProcess] Task extractor.extract[8aa6ec9e-f368-4d05-8587-6b7d3b6a07d6] raised unexpected: NotAuthorized(u'User None not authorized to read package f85ff9f1-4a89-457c-9745-313959390109',)
Traceback (most recent call last):
  File "/usr/lib/ckan/default/local/lib/python2.7/site-packages/celery/app/trace.py", line 240, in trace_task
    R = retval = fun(*args, **kwargs)
  File "/usr/lib/ckan/default/local/lib/python2.7/site-packages/celery/app/trace.py", line 438, in __protected_call__
    return self.run(*args, **kwargs)
  File "/root/ckan/lib/default/src/ckanext-extractor/ckanext/extractor/tasks.py", line 90, in extract
    {'validate': False}, {'id': res_dict['package_id']})
  File "/root/ckan/lib/default/src/ckan/ckan/logic/__init__.py", line 457, in wrapped
    result = _action(context, data_dict, **kw)
  File "/root/ckan/lib/default/src/ckan/ckan/logic/action/get.py", line 983, in package_show
    _check_access('package_show', context, data_dict)
  File "/root/ckan/lib/default/src/ckan/ckan/logic/__init__.py", line 299, in check_access
    raise NotAuthorized(msg)
NotAuthorized: User None not authorized to read package f85ff9f1-4a89-457c-9745-313959390109

[torfsen]

Thanks! A quick guess: Could it be that the package in question (f85ff9f1-4a89-457c-9745-313959390109) is private?

[torfsen]

I can reproduce the issue if the resource is part of a private dataset.

The quick solution would be to disable extraction for private datasets. The better solution would be to extract private ressources, too, so that I can use the extracted metadata when searching for private datasets. However, that would mean that we need to add access control checks in several other places, in particular to the extractor_list and extractor_show API functions. Fixing extractor_show would be rather easy (simply check if the requesting user has access to the parent dataset), but extractor_list would be more involved, since checking the access for each dataset on call time would take too much time.

[torfsen]

This has been fixed in version 0.3.1.

[gjackson12]

Thank you @torfsen!

👍