vocdoni / saas-backend / 28358378347

63%

push

github

fix(api): allow integrator API keys to delete process drafts (voting:write) (#559)

* fix(api): allow integrator API keys to delete process drafts (voting:write)

DELETE /process/{processId} was missing from the API-key allowlist
(apiKeyAllowlist in api/apikeys.go), so the deny-by-default middleware
rejected every API-key call to it with 403 40157 ("API keys are not
permitted for this endpoint"). Integrators using a scoped key could
create (POST /process), publish (POST /process/{id}/publish) and set
status (PUT /process/{id}/status) — all voting:write — but could not
delete a draft. Combined with the 2-draft-per-org cap (40031), a
quota-blocked integrator that cannot publish ends up with drafts stuck
permanently, with no key-only way to remove them.

Add "DELETE " + processEndpoint: ScopeVotingWrite to the allowlist,
mirroring the other process write ops. The delete handler already
authorizes via user.HasRoleFor(org, Manager/Admin) exactly like the
publish/status handlers, and an integrator key resolves to its creating
user who is admin of the managed org (org.Creator), so no handler change
is needed. Update the swagger annotation to note API-key support and add
a focused test asserting an integrator key can delete a managed org's
draft (and that a key without voting:write is rejected).

* fix(api): only allow deleting draft processes

DELETE /process/{id} deleted any process by ObjectID without checking
whether it was still a draft. A published process has a non-nil on-chain
address and lives on the Vochain, so removing its backend record is wrong
and leaves the election orphaned. Reject it with 409 (matching
updateProcessHandler's draft guard), so only unpublished drafts are
deletable.

Extend TestProcess to cover the published-process 409 case and seed the
draft-delete case directly (draft creation has its own quota).

4 of 4 new or added lines in 1 file covered. (100.0%)

9971 of 16011 relevant lines covered (62.28%)

44.95 hits per line