Add check for age to application create endpoint

City-of-Helsinki · Dec 16, 2024 · 3dc60f9 · 3dc60f9
1 parent e33b1c0
commit 3dc60f9
Show file tree

Hide file tree

Showing 4 changed files with 30 additions and 4 deletions.
diff --git a/tests/test_graphql_api/test_application/test_create.py b/tests/test_graphql_api/test_application/test_create.py
@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+import freezegun
 import pytest
 
 from tilavarauspalvelu.models import (
@@ -11,6 +12,7 @@
     ReservationUnitOption,
     SuitableTimeRange,
 )
+from utils.date_utils import local_datetime
 
 from tests.factories import ApplicationRoundFactory
 from tests.test_graphql_api.test_application.helpers import get_application_create_data
@@ -28,7 +30,7 @@ def test_application__create(graphql):
     # - There is an open application round
     # - A superuser is using the system
     application_round = ApplicationRoundFactory.create_in_status_open()
-    graphql.login_with_superuser()
+    graphql.login_with_superuser(date_of_birth=local_datetime(2006, 1, 1))
 
     # when:
     # - User tries to create a new application without sections
@@ -55,7 +57,7 @@ def test_application__create__with_application_sections(graphql):
     # - There is an open application round
     # - A superuser is using the system
     application_round = ApplicationRoundFactory.create_in_status_open()
-    graphql.login_with_superuser()
+    graphql.login_with_superuser(date_of_birth=local_datetime(2006, 1, 1))
 
     assert Application.objects.count() == 0
 
@@ -90,7 +92,7 @@ def test_application__create__sub_serializer_error(graphql, field):
     # - There is an open application round
     # - A superuser is using the system
     application_round = ApplicationRoundFactory.create_in_status_open()
-    graphql.login_with_superuser()
+    graphql.login_with_superuser(date_of_birth=local_datetime(2006, 1, 1))
 
     address_data = {
         "streetAddress": "Address",
@@ -116,3 +118,15 @@ def test_application__create__sub_serializer_error(graphql, field):
             "message": "This field may not be blank.",
         }
     ]
+
+
+@freezegun.freeze_time(local_datetime(2024, 1, 1))
+def test_application__create__is_under_age(graphql):
+    application_round = ApplicationRoundFactory.create_in_status_open()
+    graphql.login_with_superuser(date_of_birth=local_datetime(2006, 1, 2))
+
+    input_data = get_application_create_data(application_round)
+    response = graphql(CREATE_MUTATION, input_data=input_data)
+
+    assert response.error_message() == "Mutation was unsuccessful."
+    assert response.field_error_messages("user") == ["Application can only be created by an adult reservee"]
diff --git a/tests/test_graphql_api/test_application/test_create_permissions.py b/tests/test_graphql_api/test_application/test_create_permissions.py
@@ -2,6 +2,8 @@
 
 import pytest
 
+from utils.date_utils import local_datetime
+
 from tests.factories import ApplicationRoundFactory
 
 from .helpers import CREATE_MUTATION, get_application_create_data
@@ -33,7 +35,7 @@ def test_regular_user_can_create_application(graphql):
     # - There is an open application round
     # - A regular user is using the system
     application_round = ApplicationRoundFactory.create_in_status_open()
-    graphql.login_with_regular_user()
+    graphql.login_with_regular_user(date_of_birth=local_datetime(2006, 1, 1))
 
     # when:
     # - User tries to create a new application

diff --git a/tilavarauspalvelu/api/graphql/extensions/error_codes.py b/tilavarauspalvelu/api/graphql/extensions/error_codes.py
@@ -70,5 +70,7 @@
 APPLICATION_ROUND_NOT_IN_ALLOCATION = "APPLICATION_ROUND_NOT_IN_ALLOCATION"
 APPLICATION_ROUND_NOT_IN_RESULTS_SENT_STATE = "APPLICATION_ROUND_NOT_IN_RESULTS_SENT_STATE"
 
+APPLICATION_ADULT_RESERVEE_REQUIRED = "APPLICATION_ADULT_RESERVEE_REQUIRED"
+
 CANCEL_REASON_DOES_NOT_EXIST = "CANCEL_REASON_DOES_NOT_EXIST"
 DENY_REASON_DOES_NOT_EXIST = "DENY_REASON_DOES_NOT_EXIST"
diff --git a/tilavarauspalvelu/api/graphql/types/application/serializers.py b/tilavarauspalvelu/api/graphql/types/application/serializers.py
@@ -22,6 +22,7 @@
 from utils.fields.serializer import CurrentUserDefaultNullable
 
 if TYPE_CHECKING:
+    from tilavarauspalvelu.models import User
     from tilavarauspalvelu.typing import AnyUser
 
 
@@ -61,6 +62,13 @@ class Meta:
             },
         }
 
+    def validate_user(self, user: User) -> User:
+        if user.actions.is_ad_user or user.actions.is_of_age:
+            return user
+
+        msg = "Application can only be created by an adult reservee"
+        raise ValidationError(msg, error_codes.APPLICATION_ADULT_RESERVEE_REQUIRED)
+
 
 class ApplicationUpdateSerializer(ApplicationCreateSerializer):
     instance: Application