akvo / akvo-mis / #776

89%

main: 89%

Pull #285

coveralls-python

[#273] Scope approval batches, and let two tenants share a role name

Two gaps the read-isolation iteration left behind, found while checking
the role endpoint.

**Batches were readable across workspaces by guessing an id.** Five
endpoints — the batch's data, its comments, its summary, its attachments
— each did `get_object_or_404(DataBatch, pk=batch_id)` with no question
of whose batch it was. Batch ids are sequential, so any authenticated
submitter or approver in any workspace could walk another's pending
submissions. Queryset-level filtering could never have caught this: the
lookup does not go through a list.

`DataBatch`, `DataBatchComments` and `DataApproval` now carry the tenant
paths the read-isolation spec already assigned them but which were never
implemented, and all five lookups resolve through `for_user`.

The isolation tests pair each refusal with the same request against the
caller's own batch. A route that does not exist also answers 404, so a
404 alone would prove nothing.

**`Role.name` was globally unique**, so the second workspace to want a
"Data Entry" role could not have one — an integrity error with no
sensible message. The constraint is now per level, which is as close to
per-tenant as the schema allows: a role reaches its tenant through its
level, and Django cannot express uniqueness across a join. Nothing in
production code looked roles up by name alone.

Still unaddressed, and deliberately: `RoleAccess`, `RoleFeatureAccess`
and `QuestionOptions` were also given paths by that spec and still lack
them. Each is only reachable through a parent that is scoped, so none is
currently exposed.

5773 of 6671 branches covered (86.54%)

Branch coverage included in aggregate %.

10993 of 12193 relevant lines covered (90.16%)

0.9 hits per line