9970: Invalidate record if a requesting_container_uuid is provided at create.

diff --git a/services/api/app/models/container_request.rb b/services/api/app/models/container_request.rb
index a56c34184d49f7d2374f8cada9f8523f1beb8ac9..be5792a1cf2bc25818fca24df65afe0c72d39090 100644 (file)
--- a/services/api/app/models/container_request.rb
+++ b/services/api/app/models/container_request.rb
@@ -248,7 +248,7 @@ class ContainerRequest < ArvadosModel
   end
 
   def set_requesting_container_uuid
-    return true if self.requesting_container_uuid   # already set
+    return !new_record? if self.requesting_container_uuid   # already set
 
     token_uuid = current_api_client_authorization.andand.uuid
     container = Container.where('auth_uuid=?', token_uuid).order('created_at desc').first

diff --git a/services/api/test/unit/container_request_test.rb b/services/api/test/unit/container_request_test.rb
index ebd6a5a19adfec42eacd7bd0bccf9ab93173aa3a..7b7eef46ed3bd87942d859cb885c32dcd008a53d 100644 (file)
--- a/services/api/test/unit/container_request_test.rb
+++ b/services/api/test/unit/container_request_test.rb
@@ -242,7 +242,9 @@ class ContainerRequestTest < ActiveSupport::TestCase
     c = Container.find_by_uuid cr.container_uuid
     assert_equal 5, c.priority
 
-    cr2 = create_minimal_req!(priority: 10, state: "Committed", requesting_container_uuid: c.uuid)
+    cr2 = create_minimal_req!
+    cr2.update_attributes!(priority: 10, state: "Committed", requesting_container_uuid: c.uuid)
+    cr2.reload
 
     c2 = Container.find_by_uuid cr2.container_uuid
     assert_equal 10, c2.priority
@@ -395,4 +397,11 @@ class ContainerRequestTest < ActiveSupport::TestCase
     assert_not_empty Container.readable_by(users(:active)).where(uuid: containers(:running).uuid)
     assert_empty Container.readable_by(users(:spectator)).where(uuid: containers(:running).uuid)
   end
+
+  test "requesting_container_uuid at create is not allowed" do
+    set_user_from_auth :active
+    assert_raises(ActiveRecord::RecordNotSaved) do
+      create_minimal_req!(state: "Uncommitted", priority: 1, requesting_container_uuid: 'youcantdothat')
+    end
+  end
 end