Fix shared links allow published logic

src/api/opensearch.js

@@ -18,12 +18,12 @@ async function getSharedLink(id, opts) {
   return getDocument("shared_links", id, opts);
 }
 
-async function getDocument(index, id, opts) {
+async function getDocument(index, id, opts = {}) {
   const request = initRequest(`/${prefix(index)}/_doc/${id}`);
   let response = await awsFetch(request);
   if (response.statusCode === 200) {
     const body = JSON.parse(response.body);
-    if (index != "shared_links" && !isVisible(body, opts?.allowPrivate)) {
+    if (index != "shared_links" && !isVisible(body, opts)) {
       let responseBody = {
         _index: prefix(index),
         _type: "_doc",
@@ -40,14 +40,15 @@ async function getDocument(index, id, opts) {
   return response;
 }
 
-function isVisible(doc, allowPrivate) {
+function isVisible(doc, { allowPrivate, allowUnpublished }) {
   if (!doc?.found) return false;
-  const isAllowed = allowPrivate || doc?._source?.visibility !== "Private";
-  if (doc?._source.api_model == "FileSet") {
-    return isAllowed;
-  } else {
-    return doc?._source?.published && isAllowed;
-  }
+  const isAllowedVisibility =
+    allowPrivate || doc?._source.visibility !== "Private";
+  const isAllowedPublished =
+    allowUnpublished ||
+    doc?._source.published ||
+    doc?._source.api_model == "FileSet";
+  return isAllowedVisibility && isAllowedPublished;
 }
 
 function initRequest(path) {

src/handlers/get-shared-link-by-id.js

@@ -16,7 +16,10 @@ exports.handler = async (event) => {
   if (linkExpired(expirationDate) || !workId)
     return invalidRequest("Not Found");
 
-  const workResponse = await getWork(workId, { allowPrivate: true });
+  const workResponse = await getWork(workId, {
+    allowPrivate: true,
+    allowUnpublished: true,
+  });
   if (workResponse.statusCode !== 200) return invalidRequest("Not Found");
   const response = opensearchResponse.transform(workResponse);
   return processResponse(event, response);

test/fixtures/mocks/private-unpublished-work-1234.json

@@ -0,0 +1,13 @@
+{
+  "_index": "dev-dc-v2-work",
+  "_type": "_doc",
+  "_id": "1234",
+  "_version": 1,
+  "found": true,
+  "_source": {
+    "id": "1234",
+    "api_model": "Work",
+    "published": false,
+    "visibility": "Private"
+  }
+}

test/integration/get-shared-link-by-id.test.js

@@ -59,5 +59,45 @@ describe("Retrieve shared link by id", () => {
       const result = await handler(event);
       expect(result.statusCode).to.eq(404);
     });
+
+    it("retrieves an unpublished single shared link document", async () => {
+      mock
+        .get("/shared_links/_doc/1234")
+        .reply(200, helpers.testFixture("mocks/shared-link-1234.json"));
+
+      mock
+        .get("/dc-v2-work/_doc/1234")
+        .reply(
+          200,
+          helpers.testFixture("mocks/private-unpublished-work-1234.json")
+        );
+
+      const event = helpers
+        .mockEvent("GET", "/shared-links/{id}")
+        .pathParams({ id: 1234 })
+        .render();
+      const result = await handler(event);
+      expect(result.statusCode).to.eq(200);
+      const resultBody = JSON.parse(result.body);
+      expect(resultBody.data.api_model).to.eq("Work");
+      expect(resultBody.data.visibility).to.eq("Private");
+    });
+
+    it("returns a 404 when the link exists but the work doesn't", async () => {
+      mock
+        .get("/shared_links/_doc/1234")
+        .reply(200, helpers.testFixture("mocks/shared-link-1234.json"));
+
+      mock
+        .get("/dc-v2-work/_doc/1234")
+        .reply(200, helpers.testFixture("mocks/missing-work-1234.json"));
+
+      const event = helpers
+        .mockEvent("GET", "/shared-links/{id}")
+        .pathParams({ id: 1234 })
+        .render();
+      const result = await handler(event);
+      expect(result.statusCode).to.eq(404);
+    });
   });
 });