Trying to Access Bookings from the API Sends User to the Homepage

[PhilipRidgers]

Version

v4

Severity

Medium

Suggested Priority

Medium

Observed Behaviour

When not logged in as an admin, accessing the api with http://127.0.0.1:5001/api/bookings/1 returns the user to the Giga homepage, whether any bookings exist or not. This conflicts with one of the user stories – As a developer, So that I can build my own front-end representation of the data, I want an API providing access to gigs, bookings, accounts, etc. returned in JSON.

The user story suggests normal (non-admin) users should be able to retrieve booking data, and not being able to do so could prove an irritation to them, reducing their trust in Giga.

Expected Behaviour

http://127.0.0.1:5001/api/bookings/1 gives the correct JSON data for a user's first booking, if it exists.

Reproduction Steps

1. Type http://127.0.0.1:5001/api/bookings/1 into Google Chrome's browser address bar when not logged in as an admin.

[PaulNGilson]

Really interesting - I'd envisioned booking Ids as the database ones, not per user, so as per the current implementation it's "correct" that an admin user is the one to access all bookings.

But it could be changed so that a logged in user could get their own booking ids back. It could also be changed more radically, the way you suggest, although much more thought would need to go into determining how the user's own booking ids work, particularly in relation to the bookings table ids.