Fixes authentication on get_object_or_error

[privat-eco]

This commit introduces a change on authentication verification when calling get_object_or_error.

Previously, authentication was checked only... if object was not found.

A typical example that has highlighted this problem: before this commit if a user has generated a report URL, then this URL was available to anyone (even anonymous users) for private projects.

I think this can be considered as a breaking change (because authentication is now required for affected endpoints)

[bameda]

Hi @privat-eco

With your changes, the API can only be used by registered and authenticated users. Anonymous users can't access to Taiga to see public content.

By reviewing the test results you can see how tests for anonymous users fail (always returns 401).

For greater security of reports from the application, it is necessary to implement a different, more complex system. Sometimes the reports may be read by an application and access needs to be open (only those who know the url can access it).

Best regards