[#2579] Validate columns on ProcedurePresentation model

app/models/procedure_presentation.rb

@@ -1,3 +1,45 @@
 class ProcedurePresentation < ApplicationRecord
   belongs_to :assign_to
+
+  delegate :procedure, to: :assign_to
+
+  validate :check_allowed_displayed_fields
+  validate :check_allowed_sort_column
+  validate :check_allowed_filter_columns
+
+  def check_allowed_displayed_fields
+    displayed_fields.each do |field|
+      table = field['table']
+      column = field['column']
+      if !DossierFieldService.valid_column?(procedure, table, column)
+        errors.add(:filters, "#{table}.#{column} n’est pas une colonne permise")
+      end
+    end
+  end
+
+  def check_allowed_sort_column
+    table = sort['table']
+    column = sort['column']
+    if !valid_sort_column?(procedure, table, column)
+      errors.add(:sort, "#{table}.#{column} n’est pas une colonne permise")
+    end
+  end
+
+  def check_allowed_filter_columns
+    filters.each do |_, columns|
+      columns.each do |column|
+        table = column['table']
+        column = column['column']
+        if !DossierFieldService.valid_column?(procedure, table, column)
+          errors.add(:filters, "#{table}.#{column} n’est pas une colonne permise")
+        end
+      end
+    end
+  end
+
+  private
+
+  def valid_sort_column?(procedure, table, column)
+    DossierFieldService.valid_column?(procedure, table, column) || (table == 'notifications' && column == 'notifications')
+  end
 end

spec/factories/procedure_presentation.rb

@@ -0,0 +1,6 @@
+FactoryBot.define do
+  factory :procedure_presentation do
+    assign_to { create(:assign_to, procedure: create(:procedure, :with_type_de_champ)) }
+    sort { { "table" => "user", "column" => "email", "order" => "asc" } }
+  end
+end

spec/models/assign_to_spec.rb

@@ -7,7 +7,8 @@ describe AssignTo, type: :model do
     end
 
     context "with a procedure_presentation" do
-      let!(:assign_to) { AssignTo.create }
+      let(:procedure) { create(:procedure) }
+      let!(:assign_to) { AssignTo.create(procedure: procedure) }
       let!(:procedure_presentation) { ProcedurePresentation.create(assign_to: assign_to) }
 
       it { expect(assign_to.procedure_presentation_or_default).to eq(procedure_presentation) }

spec/models/procedure_presentation_spec.rb

@@ -1,20 +1,23 @@
 require 'spec_helper'
 
 describe ProcedurePresentation do
+  let(:assign_to) { create(:assign_to, procedure: create(:procedure, :with_type_de_champ)) }
+  let(:first_type_de_champ_id) { assign_to.procedure.types_de_champ.first.id.to_s }
   let (:procedure_presentation_id) {
     ProcedurePresentation.create(
+      assign_to: assign_to,
       displayed_fields: [
-        { "label" => "test1", "table" => "user" },
-        { "label" => "test2", "table" => "champs" }
+        { "label" => "test1", "table" => "user", "column" => "email" },
+        { "label" => "test2", "table" => "type_de_champ", "column" => first_type_de_champ_id }
       ],
       sort: { "table" => "user","column" => "email","order" => "asc" },
-      filters: { "a-suivre" => [], "suivis" => [{ "label" => "label1", "table" => "table1", "column" => "column1" }] }
+      filters: { "a-suivre" => [], "suivis" => [{ "label" => "label1", "table" => "self", "column" => "created_at" }] }
     ).id
   }
   let (:procedure_presentation) { ProcedurePresentation.find(procedure_presentation_id) }
 
   describe "#displayed_fields" do
-    it { expect(procedure_presentation.displayed_fields).to eq([{ "label" => "test1", "table" => "user" }, { "label" => "test2", "table" => "champs" }]) }
+    it { expect(procedure_presentation.displayed_fields).to eq([{ "label" => "test1", "table" => "user", "column" => "email" }, { "label" => "test2", "table" => "type_de_champ", "column" => first_type_de_champ_id }]) }
   end
 
   describe "#sort" do
@@ -22,6 +25,23 @@ describe ProcedurePresentation do
   end
 
   describe "#filters" do
-    it { expect(procedure_presentation.filters).to eq({ "a-suivre" => [], "suivis" => [{ "label" => "label1", "table" => "table1", "column" => "column1" }] }) }
+    it { expect(procedure_presentation.filters).to eq({ "a-suivre" => [], "suivis" => [{ "label" => "label1", "table" => "self", "column" => "created_at" }] }) }
+  end
+
+  describe 'validation' do
+    it { expect(build(:procedure_presentation)).to be_valid }
+
+    context 'of displayed fields' do
+      it { expect(build(:procedure_presentation, displayed_fields: [{ "table" => "user", "column" => "reset_password_token", "order" => "asc" }])).to be_invalid }
+    end
+
+    context 'of sort' do
+      it { expect(build(:procedure_presentation, sort: { "table" => "notifications", "column" => "notifications", "order" => "asc" })).to be_valid }
+      it { expect(build(:procedure_presentation, sort: { "table" => "user", "column" => "reset_password_token", "order" => "asc" })).to be_invalid }
+    end
+
+    context 'of filters' do
+      it { expect(build(:procedure_presentation, filters: { "suivis" => [{ "table" => "user", "column" => "reset_password_token", "order" => "asc" }] })).to be_invalid }
+    end
   end
 end