fix(api): ensure a 409 is raised when cancelling a user with downstream objects (#1147)

Author: Matthew Fisher

rootfs/api/tests/test_auth.py

@@ -6,7 +6,8 @@
 from django.contrib.auth.models import User
 from django.test.utils import override_settings
 from rest_framework.authtoken.models import Token
-from api.tests import DeisTestCase
+from api.tests import TEST_ROOT, DeisTestCase
+from api.models import Certificate
 
 
 class AuthTest(DeisTestCase):
@@ -242,6 +243,18 @@ def test_cancel(self):
                                       HTTP_AUTHORIZATION='token {}'.format(self.admin_token))
         self.assertEqual(response.status_code, 409)
 
+        # user can not be deleted if it has a downstream object owned by them, like a certificate
+        domain_name = 'foo.com'
+        with open('{}/certs/{}.key'.format(TEST_ROOT, domain_name)) as f:
+            key = f.read()
+        with open('{}/certs/{}.cert'.format(TEST_ROOT, domain_name)) as f:
+            cert = f.read()
+
+        Certificate.objects.create(owner=self.admin, certificate=cert, key=key)
+        response = self.client.delete(url, {'username': str(self.admin)},
+                                      HTTP_AUTHORIZATION='token {}'.format(self.admin_token))
+        self.assertEqual(response.status_code, 409, response.data)
+
     def test_passwd(self):
         """Test that a registered user can change the password."""
         # test registration workflow

rootfs/api/views.py

@@ -8,6 +8,7 @@
 from guardian.shortcuts import assign_perm, get_objects_for_user, \
     get_users_with_perms, remove_perm
 from django.views.generic import View
+from django.db.models.deletion import ProtectedError
 from rest_framework import mixins, renderers, status
 from rest_framework.exceptions import PermissionDenied, NotFound, AuthenticationFailed
 from rest_framework.permissions import IsAuthenticated
@@ -89,8 +90,11 @@ def destroy(self, request, **kwargs):
             msg = '{} still has applications assigned. Delete or transfer ownership'.format(str(target_obj))  # noqa
             raise AlreadyExists(msg)
 
-        target_obj.delete()
-        return Response(status=status.HTTP_204_NO_CONTENT)
+        try:
+            target_obj.delete()
+            return Response(status=status.HTTP_204_NO_CONTENT)
+        except ProtectedError as e:
+            raise AlreadyExists(e)
 
     def passwd(self, request, **kwargs):
         if not request.data.get('new_password'):