#434

backend/app/services/counts_export_download.rb

@@ -20,10 +20,11 @@ class CountsExportDownload
 
   def self.prepare(exporter, owner, progress: nil, check: nil, identifier: nil)
     FileUtils.mkdir_p(directory, mode: 0o700)
+    authority = HistoryAccess.authority
     slot = acquire_slot
 
     begin
-      generate(exporter, owner, progress:, check:, identifier:)
+      generate(exporter, owner, progress:, check:, identifier:, authority:)
     ensure
       slot.close
     end
@@ -40,7 +41,7 @@ class CountsExportDownload
     raise Busy
   end
 
-  def self.generate(exporter, owner, progress: nil, check: nil, identifier: nil)
+  def self.generate(exporter, owner, progress: nil, check: nil, identifier: nil, authority: HistoryAccess.authority)
     FileUtils.mkdir_p(directory, mode: 0o700)
     Dir.glob(directory.join('counts-*.export')).each do |path|
       File.unlink(path) if File.mtime(path) < Time.current - EXPIRY
@@ -80,7 +81,7 @@ class CountsExportDownload
       path = finished_path
       token = verifier.generate({ 'file' => File.basename(path),
                           'resource' => exporter.resource, 'format' => exporter.format,
-                          'owner' => owner }, expires_in: EXPIRY, purpose: 'counts_export')
+                          'owner' => owner, **authority }, expires_in: EXPIRY, purpose: 'counts_export')
       complete = true
       token
     ensure
@@ -92,6 +93,7 @@ class CountsExportDownload
   def self.find(token, owner)
     metadata = verifier.verified(token, purpose: 'counts_export')
     return unless metadata.is_a?(Hash) && metadata['owner'] == owner
+    return unless HistoryAccess.authorised_artifact?(metadata)
     return unless metadata['file']&.match?(/\Acounts-[a-zA-Z0-9_-]+\.export\z/)
     return unless CountsResourceDefinition::DEFINITIONS.key?(metadata['resource'])
     return unless ['json', 'csv'].include?(metadata['format'])