diff --git a/app/broadcast_message/rest.py b/app/broadcast_message/rest.py index 5293fa4c3..b18f8d069 100644 --- a/app/broadcast_message/rest.py +++ b/app/broadcast_message/rest.py @@ -42,15 +42,7 @@ def _parse_nullable_datetime(dt): return dt -def validate_and_update_broadcast_message_status(broadcast_message, new_status, updating_user, from_api=False): - if updating_user not in broadcast_message.service.users: - # we allow platform admins to cancel broadcasts, and we don't check user if request was done via API - if not from_api and not (new_status == BroadcastStatusType.CANCELLED and updating_user.platform_admin): - raise InvalidRequest( - f'User {updating_user.id} cannot update broadcast_message {broadcast_message.id} from other service', - status_code=400 - ) - +def validate_and_update_broadcast_message_status(broadcast_message, new_status, updating_user): if new_status not in BroadcastStatusType.ALLOWED_STATUS_TRANSITIONS[broadcast_message.status]: raise InvalidRequest( f'Cannot move broadcast_message {broadcast_message.id} from {broadcast_message.status} to {new_status}', @@ -206,6 +198,14 @@ def update_broadcast_message_status(service_id, broadcast_message_id): new_status = data['status'] updating_user = get_user_by_id(data['created_by']) + if updating_user not in broadcast_message.service.users: + # we allow platform admins to cancel broadcasts, and we don't check user if request was done via API + if not (new_status == BroadcastStatusType.CANCELLED and updating_user.platform_admin): + raise InvalidRequest( + f'User {updating_user.id} cannot update broadcast_message {broadcast_message.id} from other service', + status_code=400 + ) + validate_and_update_broadcast_message_status(broadcast_message, new_status, updating_user) return jsonify(broadcast_message.serialize()), 200 diff --git a/app/v2/broadcast/post_broadcast.py b/app/v2/broadcast/post_broadcast.py index 404b511ea..165935b54 100644 --- a/app/v2/broadcast/post_broadcast.py +++ b/app/v2/broadcast/post_broadcast.py @@ -111,7 +111,7 @@ def _cancel_or_reject_broadcast(references_to_original_broadcast, service_id): message="Broadcast message reference and service id didn't match with any existing broadcasts", status_code=404, ) - # do we need to check if service is active? + if broadcast_message.status == BroadcastStatusType.PENDING_APPROVAL: new_status = BroadcastStatusType.REJECTED else: @@ -119,8 +119,7 @@ def _cancel_or_reject_broadcast(references_to_original_broadcast, service_id): validate_and_update_broadcast_message_status( broadcast_message, new_status, - updating_user=None, - from_api=True + updating_user=None ) return broadcast_message