✨ return validation error if object is afgestoten (#1259)

backend/src/zac/core/api/tests/test_zaak_related_objects.py

@@ -1,3 +1,4 @@
+from copy import deepcopy
 from unittest.mock import patch
 
 from django.urls import reverse
@@ -133,11 +134,15 @@ def setUpClass(cls):
         )
 
         cls.user = SuperUserFactory.create()
+        cls.fetch_object_patcher = patch(
+            "zac.core.api.views.fetch_object", return_value=OBJECT_1
+        )
 
     def setUp(self):
         super().setUp()
-
         self.client.force_authenticate(self.user)
+        self.fetch_object_patcher.start()
+        self.addCleanup(self.fetch_object_patcher.stop)
 
     def test_create_object_relation(self, m):
         mock_service_oas_get(m, url=self.zrc_service.api_root, service="zrc")
@@ -181,10 +186,6 @@ def test_create_object_relation_fail_not_unique(self, m):
         mock_resource_get(m, self.zaak)
         m.get(
             f"{ZRC_ROOT}zaakobjecten?zaak={self.zaak['url']}",
-            json=paginated_response([]),
-        )
-        m.get(
-            f"{ZRC_ROOT}zaakobjecten",
             json=paginated_response(
                 [
                     {
@@ -215,6 +216,30 @@ def test_create_object_relation_fail_not_unique(self, m):
 
         self.assertEqual(status.HTTP_400_BAD_REQUEST, response.status_code)
 
+    def test_create_object_relation_fail_afgestoten(self, m):
+        mock_service_oas_get(m, url=self.zrc_service.api_root, service="zrc")
+        mock_resource_get(m, self.zaak)
+        m.get(
+            f"{ZRC_ROOT}zaakobjecten?zaak={self.zaak['url']}",
+            json=paginated_response([]),
+        )
+        obj = deepcopy(OBJECT_1)
+        obj["record"]["data"]["afgestoten"] = True
+
+        with patch("zac.core.api.views.fetch_object", return_value=obj):
+            response = self.client.post(
+                reverse(
+                    "zaakobject-create",
+                ),
+                data={
+                    "object": OBJECT_1["url"],
+                    "zaak": self.zaak["url"],
+                },
+            )
+
+        self.assertEqual(status.HTTP_400_BAD_REQUEST, response.status_code)
+        self.assertEqual(response.json(), ["Object is `afgestoten`."])
+
     def test_create_object_relation_cache_invalidation(self, m):
         mock_service_oas_get(m, url=self.zrc_service.api_root, service="zrc")
         mock_resource_get(m, self.zaak)
@@ -236,11 +261,6 @@ def test_create_object_relation_cache_invalidation(self, m):
                 "objectIdentificatie": {"overigeData": OBJECT_1["record"]["data"]},
             },
         )
-
-        m.get(
-            f"{ZRC_ROOT}zaakobjecten?zaak={self.zaak['url']}",
-            json=paginated_response([]),
-        )
         self.assertEqual(m.call_count, 0)
 
         # call to populate cache
@@ -456,7 +476,8 @@ def test_create_other_permission(self, m):
         self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
 
     @requests_mock.Mocker()
-    def test_create_has_perm(self, m):
+    @patch("zac.core.api.views.fetch_object", return_value=OBJECT_1)
+    def test_create_has_perm(self, m, *mocks):
         mock_service_oas_get(m, ZRC_ROOT, "zrc")
         mock_service_oas_get(m, CATALOGI_ROOT, "ztc")
         mock_resource_get(m, self.catalogus)
@@ -516,7 +537,8 @@ def test_create_has_perm_but_zaak_is_closed(self, m):
         self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
 
     @requests_mock.Mocker()
-    def test_create_has_perm_also_for_closed_zaak(self, m):
+    @patch("zac.core.api.views.fetch_object", return_value=OBJECT_1)
+    def test_create_has_perm_also_for_closed_zaak(self, m, *mocks):
         mock_service_oas_get(m, ZRC_ROOT, "zrc")
         mock_service_oas_get(m, CATALOGI_ROOT, "ztc")
         mock_resource_get(m, {**self.zaak, "einddatum": "2020-01-01"})

backend/src/zac/core/api/views.py

@@ -73,6 +73,7 @@
     delete_zaak_eigenschap,
     delete_zaakobject,
     fetch_latest_audit_trail_data_document,
+    fetch_object,
     fetch_zaak_eigenschap,
     fetch_zaakobject,
     fetch_zaaktype,
@@ -1437,6 +1438,19 @@ def post(self, request):
         zaak = get_zaak(zaak_url=zaak_url)
         self.check_object_permissions(self.request, zaak)
 
+        try:
+            object = fetch_object(serializer.data["object"])
+        except ClientError as exc:
+            raise serializers.ValidationError(
+                _(
+                    "Fetching OBJECT with URL: `{object}` raised a Client Error with detail: `{detail}`.".format(
+                        object=self.initial_data["object"], detail=exc.args[0]["detail"]
+                    )
+                )
+            )
+        if object["record"]["data"].get("afgestoten", False):
+            raise serializers.ValidationError(_("Object is `afgestoten`."))
+
         try:
             created_zaakobject = relate_object_to_zaak(serializer.validated_data)
         except ClientError as exc: