api: add better error handling for invalid accept/cancel POSTs (#12664)

chrono/api/views.py

@@ -15,6 +15,7 @@
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 from django.core.urlresolvers import reverse
+from django.shortcuts import get_object_or_404
 from django.utils.timezone import now
 
 from rest_framework import permissions, serializers, status
@@ -107,10 +108,18 @@ booking = BookingAPI.as_view()
 
 
 class CancelBooking(APIView):
+    '''
+    Cancel a booking.
+
+    It will return an error (code 1) if the booking was already cancelled.
+    '''
     permission_classes = (permissions.IsAuthenticated,)
 
     def post(self, request, booking_pk=None, format=None):
-        booking = Booking.objects.get(id=booking_pk, cancellation_datetime__isnull=True)
+        booking = get_object_or_404(Booking, id=booking_pk)
+        if booking.cancellation_datetime:
+            response = {'err': 1, 'reason': 'already cancelled'}
+            return Response(response)
         booking.cancel()
         response = {'err': 0, 'booking_id': booking.id}
         return Response(response)
@@ -119,12 +128,22 @@ cancel_booking = CancelBooking.as_view()
 
 
 class AcceptBooking(APIView):
+    '''
+    Accept a booking currently in the waiting list.
+
+    It will return error codes if the booking was cancelled before (code 1) and
+    if the booking was not in waiting list (code 2).
+    '''
     permission_classes = (permissions.IsAuthenticated,)
 
     def post(self, request, booking_pk=None, format=None):
-        booking = Booking.objects.get(id=booking_pk,
-                cancellation_datetime__isnull=True,
-                in_waiting_list=True)
+        booking = get_object_or_404(Booking, id=booking_pk)
+        if booking.cancellation_datetime:
+            response = {'err': 1, 'reason': 'booking is cancelled'}
+            return Response(response)
+        if not booking.in_waiting_list:
+            response = {'err': 2, 'reason': 'booking is not in waiting list'}
+            return Response(response)
         booking.accept()
         response = {'err': 0, 'booking_id': booking.id}
         return Response(response)

tests/test_api.py

@@ -125,6 +125,13 @@ def test_booking_cancellation_post_api(app, some_data, user):
     resp = app.post('/api/booking/%s/cancel/' % booking_id)
     assert Booking.objects.filter(cancellation_datetime__isnull=False).count() == 1
 
+    # cancel an object that doesn't exist
+    resp = app.post('/api/booking/%s/cancel/' % 9999, status=404)
+
+    # cancel an event that was already cancelled
+    resp = app.post('/api/booking/%s/cancel/' % booking_id, status=200)
+    assert resp.json['err'] == 1
+
 def test_soldout(app, some_data, user):
     agenda_id = Agenda.objects.filter(label=u'Foo bar')[0].id
     event = Event.objects.filter(agenda_id=agenda_id).exclude(start_datetime__lt=now())[0]
@@ -235,3 +242,19 @@ def test_accept_booking(app, some_data, user):
     resp = app.post('/api/booking/%s/accept/' % booking.id)
     assert Booking.objects.filter(in_waiting_list=True).count() == 0
     assert Booking.objects.filter(in_waiting_list=False).count() == 1
+
+    # accept a booking that doesn't exist
+    resp = app.post('/api/booking/%s/accept/' % 9999, status=404)
+
+    # accept a booking that was not in the waiting list
+    resp = app.post('/api/booking/%s/accept/' % booking.id, status=200)
+    assert resp.json['err'] == 2
+
+    # accept a booking that was cancelled before
+    booking = Booking.objects.get(id=booking.id)
+    booking.in_waiting_list = True
+    booking.cancel()
+    resp = app.post('/api/booking/%s/accept/' % booking.id, status=200)
+    assert resp.json['err'] == 1
+    assert Booking.objects.filter(in_waiting_list=True).count() == 1
+    assert Booking.objects.filter(in_waiting_list=False).count() == 0