limit permissions

Author: Andrei Neagu

services/storage/src/simcore_service_storage/modules/db/access_layer.py

@@ -338,7 +338,8 @@ async def get_file_access_rights(  # pylint:disable=too-many-return-statements #
 
                 if parent == EXPORTS_S3_PREFIX:
                     # ownership still not defined, so we assume it is user_id
-                    return AccessRights.all()
+                    # only read access is required
+                    return AccessRights(read=True, write=False, delete=False)
 
                 # otherwise assert 'parent' string corresponds to a valid UUID
                 access_rights = await self.get_project_access_rights(