diff --git a/sites/backend/src/models/set.mjs b/sites/backend/src/models/set.mjs index 4a75662ed2d..923f377493f 100644 --- a/sites/backend/src/models/set.mjs +++ b/sites/backend/src/models/set.mjs @@ -90,15 +90,25 @@ SetModel.prototype.guardedCreate = async function ({ body, user }) { */ SetModel.prototype.guardedRead = async function ({ params, user }) { /* - * Enforce RBAC - */ - if (!this.rbac.readSome(user)) return this.setResponse(403, 'insufficientAccessLevel') - - /* - * Attempt to read the record from the database + * If the set is public, we do not need to enforce RBAC + * So let's load it first */ await this.read({ id: parseInt(params.id) }) + /* + * If it's public, return early + */ + if (this.record?.public) + return this.setResponse(200, false, { + result: 'success', + set: this.asSet(), + }) + + /* + * If it's not public, enforce RBAC + */ + if (!this.rbac.readSome(user)) return this.setResponse(403, 'insufficientAccessLevel') + /* * If it does not exist, send a 404 */