pyro-api
pyro-api copied to clipboard
Fetch routes do not limit number of items for non-admin users
The routes that fetch objects from the db behave differently for admin and non-admin users. For admin, they are limited to 50 items while for non-admin users all the items are returned. For example: https://github.com/pyronear/pyro-api/blob/main/src/app/api/endpoints/alerts.py#L135
Indeed, that's a mistake but that's specific to this route because we don't use a crud function here. Hopefully, not too many routes are affected, thanks for spotting it!
This has been fixed since then: if two different scope have access to a route, the limit are the same. Thanks again 🙏