Skip to content

GitHub Issue #1214: QC Analyst role can edit assay QC state but cannot view the assay QC History table #7869

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
cnathe wants to merge 2 commits into
base: develop
Choose a base branch
from
+54 −0
Open

GitHub Issue #1214: QC Analyst role can edit assay QC state but cannot view the assay QC History table #7869

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
d498369
GH Issue 1214:GetRunQCHistoryAction to get audit events for QC state …
cnathe Jul 21, 2026
292da33
Merge remote-tracking branch 'origin/develop' into fb_assayQC1214
cnathe Jul 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
54 changes: 54 additions & 0 deletions assay/src/org/labkey/assay/AssayController.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,7 @@
import org.labkey.api.action.AbstractFileUploadAction;
import org.labkey.api.action.ApiResponse;
import org.labkey.api.action.ApiSimpleResponse;
import org.labkey.api.action.ExtendedApiQueryResponse;
import org.labkey.api.action.Marshal;
import org.labkey.api.action.Marshaller;
import org.labkey.api.action.MutatingApiAction;
Expand Down Expand Up @@ -77,6 +78,7 @@
import org.labkey.api.data.JsonWriter;
import org.labkey.api.data.MutableColumnInfo;
import org.labkey.api.data.SimpleFilter;
import org.labkey.api.data.Sort;
import org.labkey.api.data.TableInfo;
import org.labkey.api.data.TableSelector;
import org.labkey.api.defaults.DefaultValueService;
Expand Down Expand Up @@ -1482,6 +1484,58 @@ public void addNavTrail(NavTree root)
}
}

// GH Issue 1214: Returns the QC state history (assay/experiment audit events with a QC state) for a single run,
// for consumption by the assay app's run details page. A QC Analyst can edit an assay run's QC state but is not
// otherwise granted audit-log read access, so this action elevates to CanSeeAuditLog just for the history query
// (mirroring the server-rendered QCStateAction above) after confirming the caller can read the run's container.
@RequiresPermission(AssayReadPermission.class)
public static class GetRunQCHistoryAction extends ReadOnlyApiAction<RunQCHistoryForm>
{
@Override
public ApiResponse execute(RunQCHistoryForm form, BindException errors)
{
if (form.getRunId() == null)
throw new NotFoundException("A runId is required.");

// Resolve the run and confirm the (non-elevated) user can read its container BEFORE elevating, so this
// action can't be used to read audit events from a container the user otherwise can't access.
ExpRun run = ExperimentService.get().getExpRun(form.getRunId());
if (run == null || !run.getContainer().hasPermission(getUser(), ReadPermission.class))
throw new NotFoundException("Run " + form.getRunId() + " not found.");

Container runContainer = run.getContainer();
User auditUser = ElevatedUser.ensureCanSeeAuditLogRole(runContainer, getUser());
UserSchema schema = AuditLogService.getAuditLogSchema(auditUser, runContainer);
if (schema == null)
throw new NotFoundException("Audit log schema is not available.");

QuerySettings settings = new QuerySettings(getViewContext(), "qcHistory");
settings.setQueryName("ExperimentAuditEvent");
SimpleFilter filter = new SimpleFilter(FieldKey.fromParts("RunLsid"), run.getLSID());
filter.addCondition(FieldKey.fromParts("QCState"), null, CompareType.NONBLANK);
settings.setBaseFilter(filter);
settings.setBaseSort(new Sort("-Created"));

QueryView view = schema.createView(getViewContext(), settings, errors);
return new ExtendedApiQueryResponse(view, false, false, "auditLog", "ExperimentAuditEvent", 0, null, false, false, false);
}
}

public static class RunQCHistoryForm
{
private Long _runId;

public Long getRunId()
{
return _runId;
}

public void setRunId(Long runId)
{
_runId = runId;
}
}

@RequiresPermission(QCAnalystPermission.class)
public static class UpdateQCStateAction extends MutatingApiAction<UpdateQCStateForm>
{
Expand Down