Fix sending detection submissions as signed-out listener

server/lib/orcasite/radio/candidate.ex

@@ -47,11 +47,11 @@ defmodule Orcasite.Radio.Candidate do
       authorize_if always()
     end
 
-    policy action_type(:read) do
+    bypass action_type(:read) do
       authorize_if always()
     end
 
-    policy action_type(:create) do
+    bypass action_type(:create) do
       authorize_if always()
     end
 

server/lib/orcasite/radio/detection.ex

@@ -56,11 +56,11 @@ defmodule Orcasite.Radio.Detection do
       authorize_if always()
     end
 
-    policy action_type(:read) do
+    bypass action_type(:read) do
       authorize_if always()
     end
 
-    policy action_type(:create) do
+    bypass action_type(:create) do
       authorize_if always()
     end
 

server/lib/orcasite/radio/feed.ex

@@ -61,7 +61,7 @@ defmodule Orcasite.Radio.Feed do
       authorize_if always()
     end
 
-    policy action_type(:read) do
+    bypass action_type(:read) do
       authorize_if always()
     end
   end

server/test/orcasite_web/graphql/radio_test.exs

@@ -0,0 +1,72 @@
+defmodule OrcasiteWeb.RadioTest do
+  use OrcasiteWeb.ConnCase
+
+  setup do
+    feed =
+      Orcasite.Radio.Feed
+      |> Ash.Changeset.for_create(
+        :create,
+        %{
+          lat_lng_string: "48.5583362, -123.1735774",
+          name: "Orcasound Lab (Haro Strait)",
+          node_name: "rpi_orcasound_lab",
+          slug: "orcasound-lab"
+        }
+      )
+      |> Orcasite.Radio.create!()
+
+    [feed: feed]
+  end
+
+  test "unauthenticated listeners can submit a detection", %{conn: conn, feed: feed} do
+    conn =
+      conn
+      |> post("/graphql", %{
+        "query" => """
+          mutation submitDetection(
+            $feedId: String!
+            $playlistTimestamp: Int!
+            $playerOffset: Decimal!
+            $description: String!
+            $listenerCount: Int
+            $category: DetectionCategory!
+          ) {
+            submitDetection(
+              input: {
+                feedId: $feedId
+                playlistTimestamp: $playlistTimestamp
+                playerOffset: $playerOffset
+                listenerCount: $listenerCount
+                description: $description
+                category: $category
+                sendNotifications: false
+              }
+            ) {
+              result {
+                id
+              }
+              errors {
+                message
+                code
+                fields
+                shortMessage
+                vars
+              }
+            }
+          }
+        """,
+        "variables" => %{
+          "feedId" => feed.id,
+          "playlistTimestamp" => DateTime.to_unix(DateTime.utc_now()),
+          "playerOffset" => 5.54,
+          "description" => "Test detection",
+          "listenerCount" => 1,
+          "category" => "OTHER"
+        }
+      })
+
+    assert %{"data" => %{"submitDetection" => %{"errors" => [], "result" => %{"id" => id}}}} =
+             json_response(conn, 200)
+    assert "det_" <> _ = id
+  end
+end

ui/src/graphql/generated/index.ts

@@ -1078,6 +1078,14 @@ export type SubmitDetectionMutation = {
   submitDetection?: {
     __typename?: "SubmitDetectionResult";
     result?: { __typename?: "Detection"; id: string } | null;
+    errors?: Array<{
+      __typename?: "MutationError";
+      message?: string | null;
+      code?: string | null;
+      fields?: Array<string | null> | null;
+      shortMessage?: string | null;
+      vars?: { [key: string]: any } | null;
+    } | null> | null;
   } | null;
 };
 
@@ -1694,6 +1702,13 @@ export const SubmitDetectionDocument = `
     result {
       id
     }
+    errors {
+      message
+      code
+      fields
+      shortMessage
+      vars
+    }
   }
 }
     `;

ui/src/graphql/mutations/submitDetection.graphql

@@ -19,5 +19,12 @@ mutation submitDetection(
     result {
       id
     }
+    errors {
+      message
+      code
+      fields
+      shortMessage
+      vars
+    }
   }
 }