Merge pull request #1 from City-of-Turku/comment-vote-fix

Critical: Comment vote fix
tuomas777 · Nov 18, 2019 · 04598a9 · 04598a9
2 parents c36cedf + 6eb4819
commit 04598a9
Show file tree

Hide file tree

Showing 2 changed files with 41 additions and 6 deletions.
diff --git a/democracy/tests/test_section_poll.py b/democracy/tests/test_section_poll.py
@@ -224,6 +224,29 @@ def test_post_section_poll_answer_multiple_choice(john_doe_api_client, default_h
     assert set(created_data['answers'][0]['answers']) == set(data['answers'][0]['answers'])
 
 
+@pytest.mark.django_db
+def test_post_section_poll_answer_multiple_choice_second_answers(john_doe_api_client, default_hearing, geojson_feature):
+    section = default_hearing.sections.first()
+    poll = SectionPollFactory(section=section, option_count=3, type=SectionPoll.TYPE_MULTIPLE_CHOICE)
+    option1, option2, option3 = poll.options.all()
+
+    url = '/v1/hearing/%s/sections/%s/comments/' % (default_hearing.id, section.id)
+    data = get_comment_data()
+    data['answers'] = [{
+        'question': poll.id,
+        'type': SectionPoll.TYPE_MULTIPLE_CHOICE,
+        'answers': [option1.id, option3.id],
+    }]
+    response = john_doe_api_client.post(url, data=data)
+    assert response.status_code == 201
+
+    response = john_doe_api_client.post(url, data=data)
+    assert response.status_code == 400
+
+    poll.refresh_from_db(fields=['n_answers'])
+    assert poll.n_answers == 1
+
+
 @pytest.mark.django_db
 def test_patch_section_poll_answer(john_doe_api_client, default_hearing, geojson_feature):
     section = default_hearing.sections.first()

diff --git a/democracy/views/section_comment.py b/democracy/views/section_comment.py
@@ -156,12 +156,26 @@ class SectionCommentViewSet(BaseCommentViewSet):
                        GeometryBboxFilterBackend)
     ordering_fields = ('created_at', 'n_votes')
 
+    def _check_single_choice_poll(self, answer):
+        if (len(answer['answers']) > 1 and
+                SectionPoll.objects.get(id=answer['question']).type == SectionPoll.TYPE_SINGLE_CHOICE):
+            raise ValidationError({'answers': [_('A single choice poll may not have several answers.')]})
+
+    def _check_can_vote(self, answer):
+        if not answer['answers']:
+            return None
+        poll_answers = SectionPollAnswer.objects.filter(
+            option__poll=answer['question'],
+            comment__created_by=self.request.user
+        )
+        if poll_answers:
+            raise ValidationError({'answers': [_('You have already voted.')]})
+
     def create_related(self, request, instance=None, *args, **kwargs):
         answers = request.data.pop('answers', [])
         for answer in answers:
-            if (len(answer['answers']) > 1 and
-                    SectionPoll.objects.get(id=answer['question']).type == SectionPoll.TYPE_SINGLE_CHOICE):
-                raise ValidationError({'answers': [_('A single choice poll may not have several answers.')]})
+            self._check_single_choice_poll(answer)
+            self._check_can_vote(answer)
 
             for option_id in answer['answers']:
                 try:
@@ -176,9 +190,7 @@ def create_related(self, request, instance=None, *args, **kwargs):
     def update_related(self, request, instance=None, *args, **kwargs):
         answers = request.data.pop('answers', [])
         for answer in answers:
-            if (len(answer['answers']) > 1 and
-                    SectionPoll.objects.get(id=answer['question']).type == SectionPoll.TYPE_SINGLE_CHOICE):
-                raise ValidationError({'answers': [_('A single choice poll may not have several answers.')]})
+            self._check_single_choice_poll(answer)
 
             option_ids = []
             for option_id in answer['answers']: