fix: ensure that pages render if accessed via secret link

Author: carlinmack

invenio_app_rdm/records_ui/views/records.py

@@ -15,6 +15,7 @@
 
 from flask import abort, current_app, g, redirect, render_template, request, url_for
 from flask_login import current_user
+from flask_principal import AnonymousIdentity
 from invenio_base.utils import obj_or_import_string
 from invenio_communities.communities.resources.serializer import (
     UICommunityJSONSerializer,
@@ -113,6 +114,9 @@ def get_record_requests(record, identity):
     if not can_review:
         return {}
 
+    if type(identity) is AnonymousIdentity:
+        return {}  # secret link users do not have permissions to search requests
+
     record_requests = current_requests_service.search(
         identity,
         extra_filter=dsl.Q(

invenio_app_rdm/requests_ui/templates/semantic-ui/invenio_requests/community-submission/index.html

@@ -19,8 +19,15 @@
 {%- block request_header %}
   {% if is_user_dashboard %}
     {% set back_button_url = url_for("invenio_app_rdm_users.requests") %}
-  {% else %}
+  {% elif community %}
     {% set back_button_url = url_for("invenio_communities.communities_requests", pid_value=community.id) %}
+  {% else %}
+    {#
+        if you access from a secret link there is no dashboard or community
+            /access/requests/<id>?token=<token>
+        back button is not rendered if there is no URL
+    #}
+    {% set back_button_url = "" %}
   {% endif %}
   {% from "invenio_requests/macros/request_header.html" import inclusion_request_header %}
   {{ inclusion_request_header(