The reviews endpoint can return a deleted review with no indication it is deleted (original) (raw)

STR:

1. Authenticate with an admin-level user.
2. Issue a GET request for a particular review, e.g., https://addons-dev.allizom.org/api/v3/reviews/review/563182/?lang=en-US&wrap_outgoing_links=true

Expected result:

The deleted review, which is returned because the user has admin access, has some indication that it is deleted.

Actual result:

The returned review object looks just like a normal review, with no data to indicate it has been deleted.