Skip to content

fix: restrict invitation accept/decline actions to invited user only #5893

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Prashant-thakur77 wants to merge 3 commits into
base: unstable
Choose a base branch
from
+85 −2
Open

fix: restrict invitation accept/decline actions to invited user only #5893

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
e3232e3
Resolved the issue
Prashant-thakur77 May 11, 2026
116bf27
FIX issue
Prashant-thakur77 May 12, 2026
ef87eb6
added tests
Prashant-thakur77 May 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
74 changes: 74 additions & 0 deletions contentcuration/contentcuration/tests/viewsets/test_invitation.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -446,3 +446,77 @@ def test_update_invitation_decline(self):
).exists()
)
self.assertTrue(models.Change.objects.filter(channel=self.channel).exists())

def test_accept_invitation_by_channel_editor_is_forbidden(self):
invitation = models.Invitation.objects.create(**self.invitation_db_metadata)

self.client.force_authenticate(user=self.user)
response = self.client.post(
reverse("invitation-accept", kwargs={"pk": invitation.id})
)
self.assertEqual(response.status_code, 403, response.content)
invitation.refresh_from_db()
Copy link
Copy Markdown
Contributor

@rtibblesbot rtibblesbot May 12, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

praise: Using refresh_from_db() after the request to assert the DB state wasn't mutated is exactly the right way to write these tests — it catches cases where the view returns the right status code but fails to persist (or fails to NOT persist) the change. All four new tests follow this pattern.

self.assertFalse(invitation.accepted)

def test_decline_invitation_by_channel_editor_is_forbidden(self):
invitation = models.Invitation.objects.create(**self.invitation_db_metadata)

self.client.force_authenticate(user=self.user)
response = self.client.post(
reverse("invitation-decline", kwargs={"pk": invitation.id})
)
self.assertEqual(response.status_code, 403, response.content)
invitation.refresh_from_db()
self.assertFalse(invitation.declined)

def test_accept_invitation_by_unrelated_user_is_not_found(self):
invitation = models.Invitation.objects.create(**self.invitation_db_metadata)
unrelated_user = testdata.user("unrelated@example.com")

self.client.force_authenticate(user=unrelated_user)
response = self.client.post(
reverse("invitation-accept", kwargs={"pk": invitation.id})
)
self.assertEqual(response.status_code, 404, response.content)
invitation.refresh_from_db()
self.assertFalse(invitation.accepted)

def test_decline_invitation_by_unrelated_user_is_not_found(self):
invitation = models.Invitation.objects.create(**self.invitation_db_metadata)
unrelated_user = testdata.user("unrelated@example.com")

self.client.force_authenticate(user=unrelated_user)
response = self.client.post(
reverse("invitation-decline", kwargs={"pk": invitation.id})
)
self.assertEqual(response.status_code, 404, response.content)
invitation.refresh_from_db()
self.assertFalse(invitation.declined)

def test_accept_invitation_by_admin_succeeds(self):
invitation = models.Invitation.objects.create(**self.invitation_db_metadata)
admin_user = testdata.user("admin@example.com")
admin_user.is_admin = True
admin_user.save()

self.client.force_authenticate(user=admin_user)
response = self.client.post(
reverse("invitation-accept", kwargs={"pk": invitation.id})
)
self.assertEqual(response.status_code, 200, response.content)
invitation.refresh_from_db()
self.assertTrue(invitation.accepted)

def test_decline_invitation_by_admin_succeeds(self):
Copy link
Copy Markdown
Contributor

@rtibblesbot rtibblesbot May 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

praise: Adding test_decline_invitation_by_admin_succeeds without being asked is good judgment — _ensure_invitee is shared by both actions, so leaving one path untested would have been an incomplete fix.

invitation = models.Invitation.objects.create(**self.invitation_db_metadata)
admin_user = testdata.user("admin@example.com")
admin_user.is_admin = True
admin_user.save()

self.client.force_authenticate(user=admin_user)
response = self.client.post(
reverse("invitation-decline", kwargs={"pk": invitation.id})
)
self.assertEqual(response.status_code, 200, response.content)
invitation.refresh_from_db()
self.assertTrue(invitation.declined)
13 changes: 11 additions & 2 deletions contentcuration/contentcuration/viewsets/invitation.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@
from django_filters.rest_framework import FilterSet
from rest_framework import serializers
from rest_framework.decorators import action
from rest_framework.exceptions import PermissionDenied
from rest_framework.permissions import IsAuthenticated
from rest_framework.response import Response

Expand Down Expand Up @@ -137,9 +138,16 @@ def perform_update(self, serializer):
instance = serializer.save()
instance.save()

def _ensure_invitee(self, request, invitation):
if request.user.is_admin:
Copy link
Copy Markdown
Contributor

@rtibblesbot rtibblesbot May 12, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

suggestion: The is_admin bypass is intentional and consistent with the rest of the codebase, but it's currently untested. Consider adding a test like test_accept_invitation_by_admin_succeeds that creates an admin user, authenticates as them, calls the accept endpoint, and asserts a 200 with the invitation marked accepted. This closes the only untested branch in _ensure_invitee.

Copy link
Copy Markdown
Contributor Author

@Prashant-thakur77 Prashant-thakur77 May 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Added the required test,also added test_decline_invitation_by_admin_succeeds for symmetry, since _ensure_invitee is called by both actions.

return
if (request.user.email or "").lower() != (invitation.email or "").lower():
raise PermissionDenied("Only the invited user may perform this action.")

@action(detail=True, methods=["post"])
def accept(self, request, pk=None):
invitation = self.get_object()
invitation = self.get_edit_object()
self._ensure_invitee(request, invitation)
invitation.accept()
invitation.accepted = True
invitation.save()
Expand All @@ -157,7 +165,8 @@ def accept(self, request, pk=None):

@action(detail=True, methods=["post"])
def decline(self, request, pk=None):
invitation = self.get_object()
invitation = self.get_edit_object()
self._ensure_invitee(request, invitation)
invitation.declined = True
invitation.save()
Change.create_change(
Expand Down
Loading