akvo / akvo-mis / #876

89%

main: 89%

Pull #322

coveralls-python

[#307] Document the barrier-independence exception and tighten one serializer

Follow-ups from the whole-branch review of the visualization endpoint
hardening slice (Approve with follow-ups, no Critical findings), plus
the cuts an over-engineering pass turned up in the same files.

- Record on `latest_monitoring_subquery` and `get_base_monitoring_qs`
  (functions.py) that the latest-mode subquery is deliberately
  unscoped, why, and that the `latest_id` values it produces carry
  the parent form's tenancy rather than their own. Trade-off worth
  naming explicitly: `values_functions.py` relies on barrier one
  staying intact for this reason, unlike `escalation_functions.py`
  and `progress_functions.py`, which re-scope every downstream lookup
  independently. Not a fix — the design doc's closing path (add
  `user` to the subquery and scope three call sites) stays deferred,
  since it is provably safe but out of scope for this wave.
- Qualify the design doc's "the two barriers are independent by
  construction" claim with this same exception, note it only applies
  to the three endpoints that have a second barrier at all, add the
  missing `question_date` residual, and record that `/monitoring-stats`
  now 404s instead of returning `200 []` for an out-of-family
  `question_id` (unreachable from the frontend, which always supplies
  an in-family id).
- Comment `VALID_VALUES_CRITERIA_TYPES` (constants.py) to record that
  excluding `overdue` is load-bearing: the values criteria splitter
  keeps only the first question id per criterion, which `overdue`'s
  two-id shape would silently defeat.
- Make `ValuesFilterSerializer.validate()` fail when constructed
  without a user in context, instead of quietly scoping every lookup
  to `tenant IS NULL` through `for_user(None)`. Reading
  `self.context["user"]` directly is the whole fix: the subscript
  raises by itself, which is already how `EscalationFilterSerializer`
  and `ProgressFilterSerializer` fail on a mi... (continued)

6221 of 7165 branches covered (86.82%)

Branch coverage included in aggregate %.

11859 of 13038 relevant lines covered (90.96%)

0.91 hits per line