export_import: unknown component_type in urls (#88068)

chrono/apps/export_import/api_views.py

@@ -43,6 +43,13 @@ klasses_translation = {
 klasses_translation_reverse = {v: k for k, v in klasses_translation.items()}
 
 
+def get_klass_from_component_type(component_type):
+    try:
+        return klasses[component_type]
+    except KeyError:
+        raise Http404
+
+
 class Index(GenericAPIView):
     permission_classes = (permissions.IsAuthenticatedOrReadOnly,)
 
@@ -141,7 +148,7 @@ class ListComponents(GenericAPIView):
     permission_classes = (permissions.IsAuthenticatedOrReadOnly,)
 
     def get(self, request, *args, **kwargs):
-        klass = klasses[kwargs['component_type']]
+        klass = get_klass_from_component_type(kwargs['component_type'])
         order_by = 'slug'
         if klass == Group:
             order_by = 'name'
@@ -156,7 +163,7 @@ class ExportComponent(GenericAPIView):
     permission_classes = (permissions.IsAuthenticatedOrReadOnly,)
 
     def get(self, request, slug, *args, **kwargs):
-        klass = klasses[kwargs['component_type']]
+        klass = get_klass_from_component_type(kwargs['component_type'])
         serialisation = klass.objects.get(slug=slug).export_json()
         return Response({'data': serialisation})
 
@@ -168,7 +175,7 @@ class ComponentDependencies(GenericAPIView):
     permission_classes = (permissions.IsAuthenticatedOrReadOnly,)
 
     def get(self, request, slug, *args, **kwargs):
-        klass = klasses[kwargs['component_type']]
+        klass = get_klass_from_component_type(kwargs['component_type'])
         component = klass.objects.get(slug=slug)
 
         def dependency_dict(element):
@@ -182,7 +189,7 @@ component_dependencies = ComponentDependencies.as_view()
 
 
 def component_redirect(request, component_type, slug):
-    klass = klasses[component_type]
+    klass = get_klass_from_component_type(component_type)
     component = get_object_or_404(klass, slug=slug)
     if klass == Agenda:
         return redirect(reverse('chrono-manager-agenda-view', kwargs={'pk': component.pk}))

tests/api/test_applification_api.py

@@ -162,6 +162,9 @@ def test_list(app, user):
         'data': [{'id': group.pk, 'text': 'group1', 'type': 'roles', 'urls': {}, 'uuid': None}]
     }
 
+    # unknown component type
+    app.get('/api/export-import/unknown/', status=404)
+
 
 def test_export_agenda(app, user):
     app.authorization = ('Basic', ('john.doe', 'password'))
@@ -189,6 +192,9 @@ def test_export_minor_components(app, user):
     resp = app.get('/api/export-import/unavailability_calendars/foo/')
     assert resp.json['data']['label'] == 'Foo'
 
+    # unknown component type
+    app.get('/api/export-import/unknown/foo/', status=404)
+
 
 def test_agenda_dependencies_category(app, user):
     app.authorization = ('Basic', ('john.doe', 'password'))
@@ -352,6 +358,11 @@ def test_agenda_dependencies_events_type(app, user):
     }
 
 
+def test_unknown_compoment_type_dependencies(app, user):
+    app.authorization = ('Basic', ('john.doe', 'password'))
+    app.get('/api/export-import/unknown/foo/dependencies/', status=404)
+
+
 def test_redirect(app, user):
     app.authorization = ('Basic', ('john.doe', 'password'))
     agenda = Agenda.objects.create(label='Rdv', slug='rdv', kind='meetings')
@@ -380,6 +391,9 @@ def test_redirect(app, user):
     resp = app.get(redirect_url, status=302)
     assert resp.location == f'/manage/unavailability-calendar/{unavailability_calendar.pk}/'
 
+    # unknown component type
+    app.get('/api/export-import/unknown/foo/redirect/', status=404)
+
 
 def create_bundle(app, user, visible=True, version_number='42.0'):
     app.authorization = ('Basic', ('john.doe', 'password'))
@@ -570,7 +584,7 @@ def test_bundle_declare(app, user):
         content_type=ContentType.objects.get_for_model(Agenda),
         object_id=last_page.pk + 1,
     )
-    # and remove agendas to have unkown references in manifest
+    # and remove agendas to have unknown references in manifest
     Agenda.objects.all().delete()
 
     resp = app.put('/api/export-import/bundle-declare/', bundle)