Low Level API Fails on Shared Objects

[kzscisoft]

Description of Bug

If the commands to retrieve objects fetch those with are shared with the user they will sometimes fail due to the LLAPI trying to retrieve information it is not allowed to read:

RuntimeError: Retrieving abort status for run '*********' failed for url 'https://********/api/runs/********/abort' with status 403: Permission denied

Steps To Reproduce

If you have access to shared runs:

from simvue.api.objects import Run

for id_, _ in Run.get():
    print(id_)

Expected behavior

LLAPI should not attempt retrieval of private attributes of shared runs.

Setup

• OS: Ubuntu 25.10
• Python version: 3.13

[james-panayis]

What information cannot be accessed by a user who the run was shared with (and why)? Afaik the point of sharing a run is that the other person can view everything about it (including, in the example, the abort status of the run)

[alahiff]

Should be fixed by https://github.com/simvue-io/server/commit/6e765a4e5657155127856453bb204f8d5ccad190 (once deployed)

What information cannot be accessed by a user who the run was shared with (and why)?

I consider sharing currently to be an MVP. Abort status never occurred to me.

[alahiff]

For the record, the abort status is included in the response when you get details about a specific run /api/runs/<run id>/. This is what the UI makes use of, and is unrelated to this issue, which is about getting only the abort status of a run.