Data export: permissions adjustments

[hlbmtc]

Summary by CodeRabbit

• Bug Fixes
  • Improved data request validation for aggregation methods, including staff-only and date-dependent options.
  • Requests now correctly require necessary dates and reject invalid or empty selections.
  • Project-based exports include only questions from posts the requester can access.
  • Individual question exports now consistently verify permissions.
  • Inaccessible posts are skipped, while projects containing only hidden content return a not-found response.
  • Resolved question selections now correctly determine their associated post, even when post IDs are also provided.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: a750ba7a-b542-4400-a3c0-cb5e97cbea14

📥 Commits

Reviewing files that changed from the base of the PR and between 0689813 and bdec305.

📒 Files selected for processing (3)

• tests/unit/test_utils/test_middlewares.py
• tests/unit/test_utils/test_views.py
• utils/views.py

Included review availability: Your plan provides up to 2 included reviews per hour; 1 remains after this review.

---

📝 Walkthrough

Walkthrough

The pull request restricts project question exports to visible posts and changes question-based post resolution. It adds tests for aggregation validation, date handling, export authorization, and ZIP contents. It also updates a middleware test to use the settings fixture.

Changes

Export request validation and authorization

Layer / File(s)	Summary
Request resolution and export authorization utils/views.py, tests/unit/test_utils/test_views.py	Question-based requests now resolve their associated post even when post IDs are supplied. Project question queries include only questions attached to posts visible to the requesting user. Tests cover aggregation methods, required dates, identifier authorization, inaccessible posts, hidden-only projects, and successful exports.
Middleware test fixture usage tests/unit/test_utils/test_middlewares.py	The middleware tests use the settings fixture instead of importing Django settings directly.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~25 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to bdec3

The export authorization changes and accompanying tests do not show an actionable merge-blocking risk.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main change: adjustments to data export permissions.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/data-export-permissions-adjustments

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit reads each line,
The patch grows clear beneath the moon,
Small changes hop in place,
Tests guard the garden path,
Reviews bloom before the dawn.}

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Cleanup: Preview Environment Removed

The preview environment for this PR has been fully removed.

Resource	Status
🌐 Preview App	Deleted
🗄️ PostgreSQL Branch	Deleted
⚡ Redis Database	Deleted
🔧 GitHub Deployments	Removed
📦 Docker Image	Retained (auto-cleanup via GHCR policies)

---

Cleanup triggered by PR close at 2026-09-15T16:31:35Z