general: make formdatas visible even if related formdefs are disabled (#11288)

tests/test_api.py

@@ -983,6 +983,11 @@ def test_user_forms(pub, local_user):
     assert resp.json[0]['fields']['foobar'] == 'foo@localhost'
     assert resp.json[0]['keywords'] == ['hello', 'world']
 
+    formdef.disabled = True
+    formdef.store()
+    resp = get_app(pub).get(sign_uri('/api/user/forms', user=local_user))
+    assert len(resp.json) == 1
+
 def test_user_drafts(pub, local_user):
     FormDef.wipe()
     formdef = FormDef()
@@ -1020,6 +1025,11 @@ def test_user_drafts(pub, local_user):
     assert 'file' not in resp.json[0]['fields'] # no file export in full lists
     assert resp.json[0]['keywords'] == ['hello', 'world']
 
+    formdef.disabled = True
+    formdef.store()
+    resp = get_app(pub).get(sign_uri('/api/user/drafts', user=local_user))
+    assert len(resp.json) == 0
+
 def test_api_list_formdata(pub, local_user):
     Role.wipe()
     role = Role(name='test')

tests/test_form_pages.py

@@ -114,6 +114,52 @@ def test_home(pub):
     assert 'category-misc' in home.body
     assert '<a class="" href="test/">test</a>' in home.body
 
+def test_home_with_user_forms(pub):
+    user = create_user(pub)
+    formdef = create_formdef()
+    formdef.category_id = '1'
+    wf = Workflow(name='status')
+    st1 = wf.add_status('Status1', 'st1')
+    wf.store()
+    formdef.workflow_id = wf.id
+    formdef.store()
+
+    formdef.data_class().wipe()
+    formdata = formdef.data_class()()
+    formdata.user_id = user.id
+    formdata.status = 'wf-st1'
+    formdata.data = {}
+    formdata.store()
+    draft = formdef.data_class()()
+    draft.user_id = user.id
+    draft.status = 'draft'
+    draft.data = {}
+    draft.store()
+
+    app = login(get_app(pub), username='foo', password='foo')
+    resp = app.get('/')
+    assert 'Status1' in resp
+    assert '<a href="test/%s/"' % formdata.id in resp
+    assert 'Draft' in resp
+    assert '<a href="test/%s"' % draft.id in resp
+    resp = app.get('/test/%s' % formdata.id)
+    resp.status_int = 200
+    resp = app.get('/test/%s' % draft.id, status=302)
+    resp = resp.follow(status=200)
+
+    # disable formdef: formdatas are still visible and accessible, drafts are not
+    formdef.disabled = True
+    formdef.store()
+    resp = app.get('/')
+    assert 'Status1' in resp
+    assert '<a href="test/%s/"' % formdata.id in resp
+    assert not 'Draft' in resp
+    assert not '<a href="test/%s"' % draft.id in resp
+    resp = app.get('/test/%s' % formdata.id)
+    resp.status_int = 200
+    resp = app.get('/test/%s' % draft.id, status=302)
+    resp = resp.follow(status=403)
+
 def test_home_category(pub):
     formdef = create_formdef()
     formdef.category_id = '1'

wcs/api.py

@@ -417,7 +417,7 @@ class ApiUserDirectory(Directory):
         return json.dumps(user_info)
 
     def get_user_forms(self, user):
-        formdefs = FormDef.select(lambda x: not x.is_disabled())
+        formdefs = FormDef.select()
         user_forms = []
         for formdef in formdefs:
             user_forms.extend(formdef.data_class().get_with_indexed_value(
@@ -439,6 +439,8 @@ class ApiUserDirectory(Directory):
         for form in self.get_user_forms(user):
             if not form.is_draft():
                 continue
+            if form.formdef.is_disabled():
+                continue
             title = _('%(name)s, draft saved on %(datetime)s') % {
                 'name': form.formdef.name,
                 'datetime': misc.localstrftime(form.receipt_time)

wcs/forms/root.py

@@ -1218,13 +1218,13 @@ class RootDirectory(AccessControlled, Directory):
                 r += htmltext('</div>')
 
         if self.category:
-            formdefs = FormDef.select(
+            all_formdefs = FormDef.select(
                     lambda x: str(x.category_id) == str(self.category.id),
                     order_by='name', ignore_errors=True)
         else:
-            formdefs = FormDef.select(order_by='name', ignore_errors=True)
+            all_formdefs = FormDef.select(order_by='name', ignore_errors=True)
 
-        formdefs = [x for x in formdefs if (not x.is_disabled() or x.disabled_redirection)]
+        formdefs = [x for x in all_formdefs if (not x.is_disabled() or x.disabled_redirection)]
 
         if not self.category and any((x for x in formdefs if x.enable_tracking_codes)):
             r += htmltext('<div id="side">')
@@ -1245,10 +1245,9 @@ class RootDirectory(AccessControlled, Directory):
 
         user_forms = []
         if user:
-            for formdef in list_forms:
-                if not formdef.is_disabled():
-                    user_forms.extend(get_user_forms(formdef))
-                    user_forms = [x for x in user_forms if x.formdef.is_user_allowed_read(user, x)]
+            for formdef in all_formdefs:
+                user_forms.extend(get_user_forms(formdef))
+                user_forms = [x for x in user_forms if x.formdef.is_user_allowed_read(user, x)]
             user_forms.sort(lambda x,y: cmp(x.receipt_time, y.receipt_time))
 
         if self.category:
@@ -1305,7 +1304,7 @@ class RootDirectory(AccessControlled, Directory):
 
     def user_forms(self, user_forms):
         r = TemplateIO(html=True)
-        draft = [x for x in user_forms if x.is_draft()]
+        draft = [x for x in user_forms if x.is_draft() and not x.formdef.is_disabled()]
         if draft:
             r += htmltext('<h2 id="drafts">%s</h2>') % _('Your Current Drafts')
             r += htmltext('<ul>')