#434

backend/app/services/counts_export_jobs.rb

@@ -103,6 +103,7 @@ class CountsExportJobs
           'language' => language, 'resource' => exporter.resource,
           'format' => exporter.format, 'status' => 'queued',
           'processed' => 0, 'total' => nil,
+          **HistoryAccess.authority,
           'expires_at' => (Time.current + CountsExportDownload::EXPIRY).to_f }
       write(state)
       verifier.generate({ 'id' => id, 'owner' => owner },
@@ -126,6 +127,8 @@ class CountsExportJobs
       state = read(id)
       return unless state && state['owner'] == owner && state['expires_at'] > Time.current.to_f
 
+      return unless HistoryAccess.authorised_artifact?(state)
+
       if cancel && ['queued', 'running', 'ready'].include?(state['status'])
         state['status'] = state['status'] == 'running' ? 'cancelling' : 'cancelled'
         remove_download(state)
@@ -182,6 +185,22 @@ class CountsExportJobs
   end
 
   def self.perform(state)
+    actor = state['actor_id'] && User.find_by(id: state['actor_id'])
+    actor = nil unless state['admin'] && actor&.admin? && !actor.banned?
+    HistoryAccess.set(user: actor) do
+      unless HistoryAccess.authorised_artifact?(state)
+        synchronise do
+          current = read(state.fetch('id'))
+          current['status'] = 'failed'
+          write(current)
+        end
+        return
+      end
+      perform_authorised(state)
+    end
+  end
+
+  def self.perform_authorised(state)
     id = state.fetch('id')
     token = nil
     begin