Merge pull request #148 from dadosfera/fix/data-asset-sharing-permission

FIX: no permission needed for sharing data assets

src/modules/catalog/catalog.controller.ts

@@ -2,6 +2,7 @@ import {
   Body,
   Controller,
   Delete,
+  ForbiddenException,
   Get,
   HttpException,
   Inject,
@@ -21,6 +22,7 @@ import { RequestUser, User } from 'src/authentication/user.decorator';
 @ApiTags('Catalog')
 @Controller('catalog')
 @AuthenticateCondition((req, user) => {
+  if (req.path.includes('/manage_permissions/')) return true;
   let action;
 
   switch (req.method) {
@@ -205,8 +207,8 @@ export class CatalogController {
     if (dashboard.p_users.includes(user_id)) has_permission = true;
 
     if (is_data_manager || has_permission) {
-      delete res[0].p_roles;
-      delete res[0].p_users;
+      delete dashboard.p_roles;
+      delete dashboard.p_users;
       return res;
     }
 
@@ -259,14 +261,13 @@ export class CatalogController {
       if (table.p_users.includes(user_id)) has_permission = true;
 
       if (is_data_manager || has_permission) {
-        delete res[0].p_roles;
-        delete res[0].p_users;
+        delete table.p_roles;
+        delete table.p_users;
         return res;
       }
 
-      throw new HttpException(
+      throw new ForbiddenException(
         'You do not have permission to access this data asset.',
-        403,
       );
     }
   }