From f0d037c53775c0809cdf95c509050568ca161c13 Mon Sep 17 00:00:00 2001
From: unknown <gbhavya487@gmail.com>
Date: Thu, 20 Aug 2026 23:58:24 +0530
Subject: [PATCH] fix: allow multiple users to access shared dataset

---
 backend/tests/api/test_dataset.py | 96 +++++++++++++++++++++++++++++++
 backend/webserver/api/admin.py    |  2 +-
 2 files changed, 97 insertions(+), 1 deletion(-)
 create mode 100644 backend/tests/api/test_dataset.py

diff --git a/backend/tests/api/test_dataset.py b/backend/tests/api/test_dataset.py
new file mode 100644
index 00000000..db1d591c
--- /dev/null
+++ b/backend/tests/api/test_dataset.py
@@ -0,0 +1,96 @@
+import json
+
+from database import DatasetModel, UserModel
+
+class TestDatasetSharing:
+
+    @classmethod
+    def setup_class(cls):
+        DatasetModel.objects.delete()
+        UserModel.objects.delete()
+
+    def test_multiple_users_can_access_shared_dataset(self, client):
+        # First registered user becomes admin
+        response = client.post(
+            "/api/user/register",
+            json={
+                "username": "owner",
+                "password": "pass"
+            }
+        )
+        assert response.status_code == 200
+
+        # Create two additional users as admin
+        response = client.post(
+            "/api/admin/user/",
+            json={
+                "username": "user2",
+                "password": "pass",
+                "name": "User Two",
+                "isAdmin": False
+            }
+        )
+        assert response.status_code == 200
+
+        response = client.post(
+            "/api/admin/user/",
+            json={
+                "username": "user3",
+                "password": "pass",
+                "name": "User Three",
+                "isAdmin": False
+            }
+        )
+        assert response.status_code == 200
+
+        # Owner creates a dataset
+        response = client.post(
+            "/api/dataset/",
+            json={"name": "shared-dataset"}
+        )
+        assert response.status_code == 200
+
+        # Owner shares dataset with both users
+        response = client.post(
+            "/api/dataset/1/share",
+            json={"users": ["user2", "user3"]}
+        )
+        assert response.status_code == 200
+
+        # Verify users were stored
+        dataset = DatasetModel.objects(name="shared-dataset").first()
+        assert dataset.users == ["user2", "user3"]
+
+        # Verify user2 can access the dataset
+        client.get("/api/user/logout")
+        response = client.post(
+            "/api/user/login",
+            json={
+                "username": "user2",
+                "password": "pass"
+            }
+        )
+        assert response.status_code == 200
+
+        response = client.get("/api/dataset/")
+        assert response.status_code == 200
+
+        datasets = json.loads(response.data)
+        assert any(dataset["name"] == "shared-dataset" for dataset in datasets)
+
+        # Verify user3 can access the dataset
+        client.get("/api/user/logout")
+        response = client.post(
+            "/api/user/login",
+            json={
+                "username": "user3",
+                "password": "pass"
+            }
+        )
+        assert response.status_code == 200
+
+        response = client.get("/api/dataset/")
+        assert response.status_code == 200
+
+        datasets = json.loads(response.data)
+        assert any(dataset["name"] == "shared-dataset" for dataset in datasets)
\ No newline at end of file
diff --git a/backend/webserver/api/admin.py b/backend/webserver/api/admin.py
index c7575b24..3ad19807 100644
--- a/backend/webserver/api/admin.py
+++ b/backend/webserver/api/admin.py
@@ -78,7 +78,7 @@ def post(self):
         user.is_admin = args.get('isAdmin', False)
         user.save()
 
-        user_json = fix_ids(current_user)
+        user_json = fix_ids(user)
         del user_json['password']
 
         return {'success': True, 'user': user_json}