feat(demarche): create and prefill a dossier with POST request (#8233)

* add base controller for public api

* add dossiers controller with basic checks

* create the dossier

* ensure content-type is json

* prefill dossier with given values

* mark a dossier as prefilled

When a dossier is prefilled, it's allowed not to have a user.

Plus, we add a secure token to the dossier, which we will need later to set a
user after sign in / sign up.

* set user as owner of an orphan prefilled dossier

When a visitor comes from the dossier_url answered by the public api,
the dossier is orphan:
- when the user is already authenticated: they become the owner
- when the user is not authenticated: they can sign in / sign up / france_connect
and then they become the owner

So here is the procedure:
- allow to sign in / sign up / france connect when user is unauthenticated
- set dossier ownership when the dossier is orphan
- check dossier ownership when the dossier is not
- redirect to brouillon path when user is signed in and owner

* mark the dossier as prefilled when it's prefilled
(even with a GET request, because it will be useful later on, for
exmample in order to cleanup the unused prefilled dossiers)

* system spec: prefilling dossier with post request

spec/models/concern/dossier_prefillable_concern_spec.rb

@@ -8,12 +8,19 @@ RSpec.describe DossierPrefillableConcern do
 
     subject(:fill) { dossier.prefill!(values); dossier.reload }
 
+    shared_examples 'a dossier marked as prefilled' do
+      it 'marks the dossier as prefilled' do
+        expect { fill }.to change { dossier.reload.prefilled }.from(nil).to(true)
+      end
+    end
+
     context 'when champs_public_attributes is empty' do
       let(:values) { [] }
 
-      it "does nothing" do
-        expect(dossier).not_to receive(:save)
-        fill
+      it_behaves_like 'a dossier marked as prefilled'
+
+      it "doesn't change champs_public" do
+        expect { fill }.not_to change { dossier.champs_public.to_a }
       end
     end
 
@@ -30,6 +37,8 @@ RSpec.describe DossierPrefillableConcern do
 
         let(:values) { [{ id: champ_id_1, value: value_1 }, { id: champ_id_2, value: value_2 }] }
 
+        it_behaves_like 'a dossier marked as prefilled'
+
         it "updates the champs with the new values and mark them as prefilled" do
           fill
 
@@ -48,6 +57,8 @@ RSpec.describe DossierPrefillableConcern do
 
         let(:values) { [{ id: champ_id, value: value }] }
 
+        it_behaves_like 'a dossier marked as prefilled'
+
         it "still updates the champ" do
           expect { fill }.to change { dossier.champs_public.first.value }.from(nil).to(value)
         end

spec/models/dossier_spec.rb

@@ -25,6 +25,20 @@ describe Dossier do
     subject(:dossier) { create(:dossier, procedure: procedure) }
 
     it { is_expected.to validate_presence_of(:individual) }
+
+    it { is_expected.to validate_presence_of(:user) }
+
+    context 'when dossier has deleted_user_email_never_send' do
+      subject(:dossier) { create(:dossier, procedure: procedure, deleted_user_email_never_send: "seb@totoro.org") }
+
+      it { is_expected.not_to validate_presence_of(:user) }
+    end
+
+    context 'when dossier is prefilled' do
+      subject(:dossier) { create(:dossier, procedure: procedure, prefilled: true) }
+
+      it { is_expected.not_to validate_presence_of(:user) }
+    end
   end
 
   describe 'with_champs' do
@@ -1928,6 +1942,70 @@ describe Dossier do
     it { is_expected.to belong_to(:batch_operation).optional }
   end
 
+  describe '#orphan?' do
+    subject(:orphan) { dossier.orphan? }
+
+    context 'when the dossier is prefilled' do
+      context 'when the dossier has a user' do
+        let(:dossier) { build(:dossier, :prefilled) }
+
+        it { expect(orphan).to be_falsey }
+      end
+
+      context 'when the dossier does not have a user' do
+        let(:dossier) { build(:dossier, :prefilled, user: nil) }
+
+        it { expect(orphan).to be_truthy }
+      end
+    end
+
+    context 'when the dossier is not prefilled' do
+      context 'when the dossier has a user' do
+        let(:dossier) { build(:dossier) }
+
+        it { expect(orphan).to be_falsey }
+      end
+
+      context 'when the dossier does not have a user' do
+        let(:dossier) { build(:dossier, user: nil) }
+
+        it { expect(orphan).to be_falsey }
+      end
+    end
+  end
+
+  describe '#owned_by?' do
+    subject(:owned_by) { dossier.owned_by?(user) }
+
+    context 'when the dossier is orphan' do
+      let(:dossier) { build(:dossier, user: nil) }
+      let(:user) { build(:user) }
+
+      it { expect(owned_by).to be_falsey }
+    end
+
+    context 'when the given user is nil' do
+      let(:dossier) { build(:dossier) }
+      let(:user) { nil }
+
+      it { expect(owned_by).to be_falsey }
+    end
+
+    context 'when the dossier has a user and it is not the given user' do
+      let(:dossier) { build(:dossier) }
+      let(:user) { build(:user) }
+
+      it { expect(owned_by).to be_falsey }
+    end
+
+    context 'when the dossier has a user and it is the given user' do
+      let(:dossier) { build(:dossier, user: user) }
+      let(:user) { build(:user) }
+
+      it { expect(owned_by).to be_truthy }
+    end
+  end
+
   private
 
   def count_for_month(processed_by_month, month)