DELETE /api/v2/manage/customers/{identifier} should return 400 when customer is referenced in a case

Author: c8y3

source/app/blueprints/rest/v2/manage_routes/customers.py

@@ -26,6 +26,7 @@
 from app.blueprints.rest.endpoints import response_api_not_found
 from app.blueprints.rest.endpoints import response_api_deleted
 from app.blueprints.access_controls import ac_api_requires
+from app.datamgmt.exceptions.ElementExceptions import ElementInUseException
 from app.models.authorization import Permissions
 from app.schema.marshables import CustomerSchema
 from app.business.errors import ObjectNotFoundError
@@ -81,7 +82,8 @@ def delete(self, identifier):
 
         except ObjectNotFoundError:
             return response_api_not_found()
-
+        except ElementInUseException as e:
+            return response_api_error('Cannot delete a referenced customer')
 
 customers_blueprint = Blueprint('customers_rest_v2', __name__, url_prefix='/customers')
 

tests/iris.py

@@ -104,11 +104,11 @@ def create_dummy_customer(self) -> int:
         response = self.create('/manage/customers/add', {'customer_name': f'customer{uuid4()}'}).json()
         return response['data']['customer_id']
 
-    def create_dummy_case(self):
+    def create_dummy_case(self, customer_identifier=IRIS_INITIAL_CUSTOMER_IDENTIFIER):
         body = {
             'case_name': 'case name',
             'case_description': 'description',
-            'case_customer_id': 1,
+            'case_customer_id': customer_identifier,
             'case_soc_id': ''
         }
         response = self._api.post('/api/v2/cases', body).json()

tests/tests_rest_customers.py

@@ -141,3 +141,17 @@ def test_delete_customer_should_return_204(self):
 
         response = self._subject.delete(f'/api/v2/manage/customers/{identifier}')
         self.assertEqual(204, response.status_code)
+
+    def test_delete_customer_should_return_400_when_referenced_by_a_customer(self):
+        body = {'customer_name': 'customer'}
+        response = self._subject.create('/api/v2/manage/customers', body).json()
+        identifier = response['customer_id']
+
+        self._subject.create_dummy_case(identifier)
+
+        # TODO currently, to remove a customer, no user should have any access to it. I am not sure this is the optimum behavior.
+        body = {'customers_membership': [IRIS_INITIAL_CUSTOMER_IDENTIFIER]}
+        self._subject.create(f'/manage/users/{ADMINISTRATOR_USER_IDENTIFIER}/customers/update', body)
+
+        response = self._subject.delete(f'/api/v2/manage/customers/{identifier}')
+        self.assertEqual(400, response.status_code)