[Maffooch]

Description

Fixes an HTTP 500 on the V3 endpoint-compatibility detail routes (GET /api/v2/endpoints/<id>/ and GET /api/v2/endpoint_status/<id>/, active when V3_FEATURE_LOCATIONS is enabled).

These routes are served by the compatibility viewsets in dojo/location/api/endpoint_compat.py, whose rows are LocationProductReference / LocationFindingReference join rows. The shared UserHasLocationRefPermission object-permission class passed the raw join row straight to the authorization layer. user_has_permission resolves products, findings and locations, but not these join rows, so the object-permission check raised NoAuthorizationImplementedError → 500 for any authenticated, authorized, non-superuser reaching a detail route.

The fault was masked in two ways, which is why it surfaced only in production as a recurring 500:

• a superuser short-circuits the object-permission check and never reaches the unhandled branch;
• an unauthorized user is filtered out by the viewset queryset and gets a 404 before the check runs.

So only a plain member of the row's product — the common case — hit it.

Fix

Resolve the join row to its product (LocationProductReference) or finding (LocationFindingReference) before calling check_object_permission, mirroring the existing native Location(Product|Finding)ReferencePermission classes. This hands the authorization layer an object it already knows how to authorize, so the same change fixes both the open-source and Pro authorization implementations with no change needed on the Pro side. No migration and no model change.

Test results

Added unittests/test_v3_endpoint_compat_api_authz.py, which drives both detail routes as an authorized non-superuser product member:

• before the fix both routes return 500 (NoAuthorizationImplementedError);
• after the fix both return 200.

Verified locally against Postgres on dev. The new tests plus the existing endpoint/location authorization suites (test_v3_endpoint_route_authz, test_apiv2_endpoint_deprecation_contract, test_apiv2_endpoint, test_endpoint_status_cross_product_authz, test_location_finding_reference_authz, test_v3_location_reference_authz) all pass. Ruff clean.

Documentation

No documentation change — this restores the documented behavior of existing routes; no new feature or setting.

Checklist

• Rebased against the latest dev.
• Submitted against the dev branch.
• Ruff compliant.
• Python 3.13 compliant.
• No model changes / no migration.
• Added unit tests.

---

Generated by Claude Code