From cdd50fe0e6dab511778ab5f0149674116138285b Mon Sep 17 00:00:00 2001
From: Nell Hardcastle <nell@dev-nell.com>
Date: Thu, 13 Nov 2025 09:15:06 -0800
Subject: [PATCH] fix(server): Allow worker tokens to read datasets

---
 packages/openneuro-server/src/graphql/permissions.ts | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/packages/openneuro-server/src/graphql/permissions.ts b/packages/openneuro-server/src/graphql/permissions.ts
index 6f218570a..68ebcbd9f 100644
--- a/packages/openneuro-server/src/graphql/permissions.ts
+++ b/packages/openneuro-server/src/graphql/permissions.ts
@@ -95,6 +95,10 @@ export const checkDatasetRead = async (datasetId, userId, userInfo) => {
       return true
     }
   }
+  // Allow worker scoped tokens to read specific datasets
+  if (userId && userInfo?.worker && datasetId === userInfo?.dataset) {
+    return true
+  }
   // Check that dataset exists.
   await checkDatasetExists(datasetId)
   // Look for any matching datasets