Cannot respond to a transfer after first response

CHANGELOG.md

@@ -4,6 +4,7 @@
 
 - Harvest attribution roles [#3149](https://github.com/opendatateam/udata/pull/3149)
 - Allow super-admins to change objects' owners [#3260](https://github.com/opendatateam/udata/pull/3260)
+- Cannot respond to a transfer after first response [#3255](https://github.com/opendatateam/udata/pull/3255)
 - Fix contact point permissions [#3253](https://github.com/opendatateam/udata/pull/3253)
 - Fix wrong marshal for community resource uploads [#3261](https://github.com/opendatateam/udata/pull/3261)
 - Return harvesters's errors details only for super-admins [#3264](https://github.com/opendatateam/udata/pull/3264)

udata/features/transfer/api.py

@@ -1,4 +1,4 @@
-from flask import request
+from flask import abort, request
 
 from udata.api import API, api, base_reference, fields
 from udata.core.dataservices.models import Dataservice
@@ -27,7 +27,7 @@
         "recipient": fields.Nested(
             base_reference,
             required=True,
-            description=("The transfer recipient, " "either an user or an organization"),
+            description=("The transfer recipient, either an user or an organization"),
         ),
         "comment": fields.String(
             description="An explanation about the transfer request", required=True
@@ -68,12 +68,12 @@
         "owner": fields.Polymorph(
             person_mapping,
             readonly=True,
-            description=("The user or organization currently owning " "the transfered object"),
+            description=("The user or organization currently owning the transfered object"),
         ),
         "recipient": fields.Polymorph(
             person_mapping,
             readonly=True,
-            description=("The user or organization receiving " "the transfered object"),
+            description=("The user or organization receiving the transfered object"),
         ),
         "subject": fields.Polymorph(
             subject_mapping, readonly=True, description="The transfered object"
@@ -186,6 +186,9 @@ def post(self, id):
         """Respond to a transfer request"""
         transfer = Transfer.objects.get_or_404(id=id_or_404(id))
 
+        if transfer.status != "pending":
+            abort(400, "Cannot update transfer after accepting/refusing")
+
         data = request.json
         comment = data.get("comment")
 

udata/tests/api/test_transfer_api.py

@@ -2,8 +2,10 @@
 from flask import url_for
 
 from udata.core.dataset.factories import DatasetFactory
+from udata.core.dataset.models import Dataset
 from udata.core.organization.factories import OrganizationFactory
 from udata.core.user.factories import UserFactory
+from udata.core.user.models import User
 from udata.utils import faker
 
 from . import APITestCase
@@ -214,3 +216,39 @@ def test_400_on_bad_recipient(self):
         data = response.json
 
         self.assertIn("recipient", data["errors"])
+
+    def test_cannot_accept_or_refuse_transfer_after_accepting_or_refusing(self):
+        user = self.login()
+        new_user = UserFactory()
+        dataset = DatasetFactory(owner=user)
+
+        response = self._create_transfer(dataset, new_user)
+        self.assert201(response)
+
+        transfer = response.json
+
+        self.login(new_user)
+        response = self.post(url_for("api.transfer", id=transfer["id"]), {"response": "accept"})
+        self.assert200(response)
+
+        response = self.post(url_for("api.transfer", id=transfer["id"]), {"response": "accept"})
+        self.assert400(response)
+
+        response = self.post(url_for("api.transfer", id=transfer["id"]), {"response": "refuse"})
+        self.assert400(response)
+
+    def _create_transfer(self, source: Dataset, destination: User):
+        return self.post(
+            url_for("api.transfers"),
+            {
+                "subject": {
+                    "class": "Dataset",
+                    "id": str(source.id),
+                },
+                "recipient": {
+                    "class": "User",
+                    "id": str(destination.id),
+                },
+                "comment": "Some comment",
+            },
+        )