Ticket #2619 (assigned enhancement)

Opened 22 months ago

Last modified 18 months ago

Omit private datasets from public activity streams

Reported by: seanh Owned by: seanh
Priority: awaiting triage Milestone: ckan-v1.9
Component: ckan Keywords: activity_streams organizations
Cc: Repository: ckan
Theme: none


Activities about private datasets should not appear in public activity streams.

I don't think you want to actually purge the activities from the db, because you might still want them to appear in private activity streams.

I do think that when a dataset goes private all its past activity should go private, because I imagine that users are going to want to hide everything about the dataset and not have any past activities 'leaking out'

I don't think you want to consider whether the dataset was private when the activity happened, rather if a dataset is private now then all its past activities are private (and the simplest thing would be to say that if a dataset is public now then all its past activities become public as well, but is that a privacy concern?)

The easiest way to implement this is going to be by modifying the *_activity_list() action functions in get.py, after they pull their activity lists out of the db they should pass them through a function that filters out stuff about private datasets.

An activity about a private dataset is one whose object_type is 'dataset' and whose object_id matches the id of a private dataset. You should also check the object_type and object_id of all of the activity object's activity detail objects, if any of those match a private dataset then mark the whole activity as private.

Currently all activity streams are public so should have all private datasets filtered out from them, except for the dashboard activity stream which is private to the individual user. In this case private datasets that the user has permission to see should not be filtered.

Change History

comment:1 Changed 22 months ago by seanh

A thought about efficiency, you probably don't want to pass all the activities through the filter function since only the most recent 15 will be shown anyway. Suggest a filter function with an optional limit=15 argument, you pass it the whole activity list and it iterates over it until it has found 15 public ones then immediately returns those.

comment:2 Changed 22 months ago by seanh

  • Owner set to rossjones
  • Status changed from new to assigned

comment:3 Changed 22 months ago by seanh

  • Owner changed from rossjones to ross

comment:4 Changed 22 months ago by ross

  • Milestone set to ckan-v1.9

comment:5 Changed 20 months ago by ross

  • Owner changed from ross to seanh

Have a push request with a privacy flag which might be useful in determining the status of the dataset (public/private) but no idea if it will be accepted yet.

Have assigned back to you for safe-keeping so it doesn't get lost in backlog.

comment:6 Changed 18 months ago by seanh

I think we need a function that filters out all activities and activity details where the user doesn't have permission to read either the subject or object of the activity or any of its activity details. Each of the *_activity_list() functions can then use it.

Note: See TracTickets for help on using tickets.