ckan/ckan — pull request #1652 by amercader (2014-04-17 16:38:58+00:00)
Title: Creating a DataStore resource with the package_id fails for a normal user

When creating a new DataStore resource (eg one that does not point to a file but that only has a DataStore table) there is the option to provide the id for the dataset and create the resource at the same time as the DataStore table:

```json
{
"resource": {
"package_id": "xxxxxx"
},
"fields": [],
"records": [],
"aliases": [],
}
```

This is not taken into account on the [datastore auth logic](https://github.com/ckan/ckan/blob/master/ckanext/datastore/logic/auth.py), where all auth is expected to be run against a resource, not a dataset:

```python
def datastore_auth(context, data_dict, privilege='resource_update'):
if not 'id' in data_dict:
data_dict['id'] = data_dict.get('resource_id')
user = context.get('user')

authorized = p.toolkit.check_access(privilege, context, data_dict)
```

That effectively means that unless you are creating the DataStore table as a sysadmin, and thus the auth is completely bypassed you will get a validation error, as the auth won't find a resource to check against:

```json
{"success": false, "error": {"message": "Missig id, can not get Resource object", "__type": "Validation Error"}}
```