Merge pull request #5751 from betagouv/dev

2020-11-18-01

app/controllers/super_admins_controller.rb

@@ -22,6 +22,7 @@ class SuperAdminsController < ApplicationController
 
   def generate_qr_code
     issuer = 'DSManager'
+    issuer += "-dev" if Rails.env.development?
     label = "#{issuer}:#{current_super_admin.email}"
     RQRCode::QRCode.new(current_super_admin.otp_provisioning_uri(label, issuer: issuer))
   end

app/graphql/mutations/base_mutation.rb

@@ -1,4 +1,16 @@
 module Mutations
   class BaseMutation < GraphQL::Schema::RelayClassicMutation
+    def validate_blob(blob_id)
+      if blob_id.present?
+        begin
+          blob = ActiveStorage::Blob.find_signed(blob_id)
+          blob.identify
+        rescue ActiveStorage::FileNotFoundError
+          return { errors: ['Le fichier n’a pas été correctement téléversé sur le serveur de stockage'] }
+        rescue ActiveSupport::MessageVerifier::InvalidSignature
+          return { errors: ['L’identifiant du fichier téléversé est invalide'] }
+        end
+      end
+    end
   end
 end

app/graphql/mutations/dossier_accepter.rb

@@ -14,6 +14,10 @@ module Mutations
 
     def resolve(dossier:, instructeur:, motivation: nil, justificatif: nil)
       if dossier.en_instruction?
+        errors = validate_blob(justificatif)
+        if errors
+          return errors
+        end
         dossier.accepter!(instructeur, motivation, justificatif)
 
         { dossier: dossier }

app/graphql/mutations/dossier_classer_sans_suite.rb

@@ -14,6 +14,10 @@ module Mutations
 
     def resolve(dossier:, instructeur:, motivation:, justificatif: nil)
       if dossier.en_instruction?
+        errors = validate_blob(justificatif)
+        if errors
+          return errors
+        end
         dossier.classer_sans_suite!(instructeur, motivation, justificatif)
 
         { dossier: dossier }

app/graphql/mutations/dossier_envoyer_message.rb

@@ -11,6 +11,10 @@ module Mutations
     field :errors, [Types::ValidationErrorType], null: true
 
     def resolve(dossier:, instructeur:, body:, attachment: nil)
+      errors = validate_blob(attachment)
+      if errors
+        return errors
+      end
       message = CommentaireService.build(instructeur, dossier, body: body, piece_jointe: attachment)
 
       if message.save

app/graphql/mutations/dossier_refuser.rb

@@ -14,6 +14,10 @@ module Mutations
 
     def resolve(dossier:, instructeur:, motivation:, justificatif: nil)
       if dossier.en_instruction?
+        errors = validate_blob(justificatif)
+        if errors
+          return errors
+        end
         dossier.refuser!(instructeur, motivation, justificatif)
 
         { dossier: dossier }

app/models/dossier.rb

@@ -74,7 +74,7 @@ class Dossier < ApplicationRecord
   has_many :avis, inverse_of: :dossier, dependent: :destroy
   has_many :traitements, -> { order(:processed_at) }, inverse_of: :dossier, dependent: :destroy
 
-  has_many :dossier_operation_logs, -> { order(:created_at) }, dependent: :nullify, inverse_of: :dossier
+  has_many :dossier_operation_logs, -> { order(:created_at) }, inverse_of: :dossier
 
   belongs_to :groupe_instructeur, optional: false
   belongs_to :revision, class_name: 'ProcedureRevision', optional: false

db/migrate/20201117122923_remove_dossier_operation_log_foreign_key.rb

@@ -0,0 +1,5 @@
+class RemoveDossierOperationLogForeignKey < ActiveRecord::Migration[6.0]
+  def change
+    remove_foreign_key :dossier_operation_logs, :dossiers
+  end
+end

db/schema.rb

@@ -10,7 +10,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema.define(version: 2020_11_10_155516) do
+ActiveRecord::Schema.define(version: 2020_11_17_122923) do
 
   # These are extensions that must be enabled in order to support this database
   enable_extension "plpgsql"
@@ -709,7 +709,6 @@ ActiveRecord::Schema.define(version: 2020_11_10_155516) do
   add_foreign_key "closed_mails", "procedures"
   add_foreign_key "commentaires", "dossiers"
   add_foreign_key "dossier_operation_logs", "bill_signatures"
-  add_foreign_key "dossier_operation_logs", "dossiers"
   add_foreign_key "dossier_operation_logs", "instructeurs"
   add_foreign_key "dossiers", "groupe_instructeurs"
   add_foreign_key "dossiers", "procedure_revisions", column: "revision_id"

spec/controllers/api/v2/graphql_controller_spec.rb

@@ -604,6 +604,34 @@ describe API::V2::GraphqlController do
             })
           end
         end
+
+        context 'upload error' do
+          let(:query) do
+            "mutation {
+              dossierEnvoyerMessage(input: {
+                dossierId: \"#{dossier.to_typed_id}\",
+                instructeurId: \"#{instructeur.to_typed_id}\",
+                body: \"Hello world\",
+                attachment: \"fake\"
+              }) {
+                message {
+                  body
+                }
+                errors {
+                  message
+                }
+              }
+            }"
+          end
+
+          it "should fail" do
+            expect(gql_errors).to eq(nil)
+            expect(gql_data).to eq(dossierEnvoyerMessage: {
+              errors: [{ message: "L’identifiant du fichier téléversé est invalide" }],
+              message: nil
+            })
+          end
+        end
       end
 
       describe 'dossierPasserEnInstruction' do