Merge branch 'master' into ag-hide-disabled-things

Conflicts:
	src/metabase/api/meta/db.clj
	src/metabase/api/meta/table.clj

src/metabase/api/dash.clj

@@ -44,6 +44,7 @@
   "Get `Dashboard` with ID."
   [id]
   (let-404 [db (-> (sel :one Dashboard :id id)
+                   read-check
                    (hydrate :creator :organization [:ordered_cards [:card :creator]] :can_read :can_write))]
     {:dashboard db})) ; why is this returned with this {:dashboard} wrapper?
 

src/metabase/api/emailreport.clj

@@ -107,7 +107,6 @@
                                  :version         (inc (:version report)))))
   (-> (sel :one EmailReport :id id)
       (hydrate :creator :database :can_read :can_write)))
-    ;; TODO - deal with recipients
 
 
 (defendpoint DELETE "/:id" [id]

src/metabase/api/meta/db.clj

@@ -112,6 +112,7 @@
 (defendpoint GET "/:id/tables"
   "Get a list of all `Tables` in `Database`."
   [id]
+  (read-check Database id)
   (sel :many Table :db_id id :active true (order :name)))
 
 (defendpoint GET "/:id/idfields"
@@ -126,6 +127,7 @@
   "Update the metadata for this `Database`."
   [id]
   (let-404 [db (sel :one Database :id id)]
+    (write-check db)
     (future (driver/sync-database db))) ; run sync-tables asynchronously
   {:status :ok})
 

src/metabase/api/meta/table.clj

 (ns metabase.api.meta.table
   "/api/meta/table endpoints."
-  (:require [clojure.tools.logging :as log]
-            [compojure.core :refer [GET POST PUT]]
+  (:require [compojure.core :refer [GET POST PUT]]
             [korma.core :refer :all]
-            [medley.core :as m]
             [metabase.api.common :refer :all]
             [metabase.db :refer :all]
             (metabase.models [hydrate :refer :all]
-              [database :refer [Database]]
-              [field :refer [Field]]
-              [foreign-key :refer [ForeignKey]]
-              [table :refer [Table] :as table])
-            [metabase.util :as u]
+                             [database :refer [Database]]
+                             [field :refer [Field]]
+                             [foreign-key :refer [ForeignKey]]
+                             [org :refer [Org]]
+                             [table :refer [Table] :as table])
             [metabase.driver :as driver]))
 
 (defannotation TableEntityType
@@ -23,6 +21,7 @@
   "Get all `Tables` for an `Org`."
   [org]
   {org Required}
+  (read-check Org org)
   (let [db-ids (sel :many :id Database :organization_id org)]
     (-> (sel :many Table :active true :db_id [in db-ids] (order :name :ASC))
         (hydrate :db))))
@@ -32,6 +31,7 @@
   "Get `Table` with ID."
   [id]
   (->404 (sel :one Table :id id)
+         read-check
          (hydrate :db :pk_field)))
 
 (defendpoint PUT "/:id"
@@ -48,11 +48,12 @@
 (defendpoint GET "/:id/fields"
   "Get all `Fields` for `Table` with ID."
   [id]
-  ;; TODO: READ CHECK ?
+  (read-check Table id)
   (sel :many Field :table_id id :active true (order :name :ASC)))
 
 (defendpoint GET "/:id/query_metadata" [id]
   (->404 (sel :one Table :id id)
+         read-check
          (hydrate :db [:fields [:target]] :field_values)))
 
 (defendpoint GET "/:id/fks"