From f76d6430dff3210135b428945219c74c66129ab2 Mon Sep 17 00:00:00 2001
From: Jad <jad.saad@aot-technologies.com>
Date: Fri, 7 Jul 2023 11:55:28 -0700
Subject: [PATCH] validate survey during update

---
 .../src/met_api/resources/report_setting.py   | 20 ++-----------------
 .../services/report_setting_service.py        | 16 ++++++++++-----
 2 files changed, 13 insertions(+), 23 deletions(-)

diff --git a/met-api/src/met_api/resources/report_setting.py b/met-api/src/met_api/resources/report_setting.py
index be77c2ce2..730dc452e 100644
--- a/met-api/src/met_api/resources/report_setting.py
+++ b/met-api/src/met_api/resources/report_setting.py
@@ -53,22 +53,6 @@ def get(survey_id):
         except ValueError as err:
             return str(err), HTTPStatus.INTERNAL_SERVER_ERROR
 
-    @staticmethod
-    # @TRACER.trace()
-    @cross_origin(origins=allowedorigins())
-    @_jwt.requires_auth
-    def post(survey_id):
-        """Refresh the report setting to match the questions on survey."""
-        try:
-            requestjson = request.get_json()
-            report_setting = ReportSettingService().refresh_report_setting(requestjson)
-
-            return jsonify(report_setting), HTTPStatus.OK
-        except KeyError as err:
-            return str(err), HTTPStatus.INTERNAL_SERVER_ERROR
-        except ValueError as err:
-            return str(err), HTTPStatus.INTERNAL_SERVER_ERROR
-
     @staticmethod
     # @TRACER.trace()
     @cross_origin(origins=allowedorigins())
@@ -76,8 +60,8 @@ def post(survey_id):
     def patch(survey_id):
         """Update saved report setting partially."""
         try:
-            requestjson = request.get_json()
-            report_setting = ReportSettingService().update_report_setting(requestjson)
+            new_report_settings = request.get_json()
+            report_setting = ReportSettingService().update_report_setting(survey_id, new_report_settings)
 
             return jsonify(report_setting), HTTPStatus.OK
         except KeyError as err:
diff --git a/met-api/src/met_api/services/report_setting_service.py b/met-api/src/met_api/services/report_setting_service.py
index 2810ca46b..72a3337d3 100644
--- a/met-api/src/met_api/services/report_setting_service.py
+++ b/met-api/src/met_api/services/report_setting_service.py
@@ -1,6 +1,7 @@
 """Service for report setting management."""
 
 from met_api.models.report_setting import ReportSetting as ReportSettingModel
+from met_api.models.survey import Survey as SurveyModel
 from met_api.schemas.report_setting import ReportSettingSchema
 from met_api.constants.report_setting_type import FormIoComponentType
 
@@ -136,15 +137,20 @@ def _delete_questions_removed_from_form(cls, survey_id, survey_question_keys):
                 ReportSettingModel.delete_report_settings(survey_id, report_setting['question_key'])
 
     @classmethod
-    def update_report_setting(cls, report_setting_data):
+    def update_report_setting(cls, survey_id, new_report_settings):
         """Update report setting."""
-        for data in report_setting_data:
-            report_setting_id = data.get('id', None)
+        survey = SurveyModel.find_by_id(survey_id)
+        if not survey:
+                raise KeyError(f'No survey found for {survey_id}')
+        for setting in new_report_settings:
+            report_setting_id = setting.get('id', None)
             report_setting = ReportSettingModel.find_by_id(report_setting_id)
             if not report_setting:
                 raise ValueError(f'No report setting found for {report_setting_id}')
+            if report_setting.survey_id != survey_id:
+                raise KeyError(f'Report setting {report_setting.id} does not belong to survey {survey_id}')
 
-            report_setting.display = data.get('display', None)
+            report_setting.display = setting.get('display', None)
             report_setting.save()
 
-        return report_setting_data
+        return new_report_settings