Only check access permissions in /api/{history_dataset_collection_id}/contents/{dataset_collection_id}

[ahmedhamidawan]

Only check ownership in __get_history_collection_instance if:
collection_instance.history.published = False

Fixes #17252
Closes #15917

-

Is this currently the right way to go about this or do we also need to add a published param to the api as well to add context?...

How to test the changes?

(Select all options that apply)

• I've included appropriate automated tests.
• This is a refactoring of components with existing test coverage.
• Instructions for manual testing are as follows:
  1. [add testing steps and prerequisites here if you didn't write automated tests covering all your changes]

License

• I agree to license these and all my past contributions to the core galaxy codebase under the MIT license.

[mvdbeek]

I don't think you want to target 23.0 ?

[ahmedhamidawan]

I don't think you want to target 23.0 ?

Sorry, I changed the base to dev

[mvdbeek]

Yes, looks good, thank you! Any chance you could add an API test ?
First part of that test could just look like https://github.com/mvdbeek/galaxy/blob/b7652623b424506363183393795e851476574856/lib/galaxy_test/api/test_dataset_collections.py#L413-L420, and then publish the history with self.dataset_populatior.make_public(history_id) and check that a different user can list the contents ?