Merge branch 'main' into MAIN-B-20131-sc-edit-full-address

pkg/handlers/ghcapi/move.go

@@ -15,6 +15,7 @@ import (
 	"github.com/transcom/mymove/pkg/gen/ghcmessages"
 	"github.com/transcom/mymove/pkg/handlers"
 	"github.com/transcom/mymove/pkg/handlers/ghcapi/internal/payloads"
+	"github.com/transcom/mymove/pkg/models"
 	"github.com/transcom/mymove/pkg/services"
 )
 
@@ -46,6 +47,11 @@ func (h GetMoveHandler) Handle(params moveop.GetMoveParams) middleware.Responder
 				}
 			}
 
+			privileges, err := models.FetchPrivilegesForUser(appCtx.DB(), appCtx.Session().UserID)
+			if err != nil {
+				appCtx.Logger().Error("Error retreiving user privileges", zap.Error(err))
+			}
+
 			// if this user is accessing the move record, we need to lock it so others can't edit it
 			// to allow for locking a move, we need to look at these things
 			// 1. Is the user an office user?
@@ -66,8 +72,18 @@ func (h GetMoveHandler) Handle(params moveop.GetMoveParams) middleware.Responder
 				}
 			}
 
-			payload := payloads.Move(move)
-			return moveop.NewGetMoveOK().WithPayload(payload), nil
+			moveOrders, err := models.FetchOrder(appCtx.DB(), move.OrdersID)
+			if err != nil {
+				appCtx.Logger().Error("Error retreiving user privileges", zap.Error(err))
+			}
+
+			if moveOrders.OrdersType == "SAFETY" && !privileges.HasPrivilege(models.PrivilegeTypeSafety) {
+				appCtx.Logger().Error("Invalid permissions")
+				return moveop.NewGetMoveNotFound(), nil
+			} else {
+				payload := payloads.Move(move)
+				return moveop.NewGetMoveOK().WithPayload(payload), nil
+			}
 		})
 }
 

pkg/handlers/ghcapi/move_test.go

@@ -111,7 +111,7 @@ func (suite *HandlerSuite) TestGetMoveHandler() {
 				Type:     &factory.TransportationOffices.CloseoutOffice,
 			},
 		}, nil)
-		moveFetcher := moveservice.NewMoveFetcher()
+		mockFetcher := mocks.MoveFetcher{}
 		mockLocker := movelocker.NewMoveLocker()
 		requestOfficeUser := factory.BuildOfficeUserWithRoles(suite.DB(), nil, []roles.RoleType{roles.RoleTypeServicesCounselor})
 
@@ -126,10 +126,16 @@ func (suite *HandlerSuite) TestGetMoveHandler() {
 
 		handler := GetMoveHandler{
 			HandlerConfig: suite.HandlerConfig(),
-			MoveFetcher:   moveFetcher,
+			MoveFetcher:   &mockFetcher,
 			MoveLocker:    mockLocker,
 		}
 
+		mockFetcher.On("FetchMove",
+			mock.AnythingOfType("*appcontext.appContext"),
+			move.Locator,
+			mock.Anything,
+		).Return(&move, nil)
+
 		response := handler.Handle(params)
 		suite.IsType(&moveops.GetMoveOK{}, response)
 		payload := response.(*moveops.GetMoveOK).Payload
@@ -228,6 +234,40 @@ func (suite *HandlerSuite) TestGetMoveHandler() {
 		// Validate outgoing payload: nil payload
 		suite.Nil(payload)
 	})
+
+	suite.Run("Unsuccessful move fetch - invalid privileges", func() {
+		setupTestData()
+		mockFetcher := mocks.MoveFetcher{}
+		mockLocker := movelocker.NewMoveLocker()
+
+		handler := GetMoveHandler{
+			HandlerConfig: suite.HandlerConfig(),
+			MoveFetcher:   &mockFetcher,
+			MoveLocker:    mockLocker,
+		}
+
+		mockFetcher.On("FetchMove",
+			mock.AnythingOfType("*appcontext.appContext"),
+			move.Locator,
+			mock.Anything,
+		).Return(&models.Move{}, apperror.NotFoundError{})
+
+		req := httptest.NewRequest("GET", "/move/#{move.locator}", nil)
+		req = suite.AuthenticateUserRequest(req, requestUser.User)
+		params := moveops.GetMoveParams{
+			HTTPRequest: req,
+			Locator:     move.Locator,
+		}
+
+		// Validate incoming payload: no body to validate
+
+		response := handler.Handle(params)
+		suite.IsType(&moveops.GetMoveNotFound{}, response)
+		payload := response.(*moveops.GetMoveNotFound).Payload
+
+		// Validate outgoing payload: nil payload
+		suite.Nil(payload)
+	})
 }
 
 func (suite *HandlerSuite) TestSearchMovesHandler() {

pkg/handlers/internalapi/uploads.go

@@ -122,6 +122,17 @@ func (h DeleteUploadHandler) Handle(params uploadop.DeleteUploadParams) middlewa
 				return handlers.ResponseForError(appCtx.Logger(), err), err
 			}
 
+			var ppmShipmentStatus models.PPMShipmentStatus
+
+			if params.PpmID != nil {
+				ppmShipmentId, _ := uuid.FromString(params.PpmID.String())
+				ppmShipment, err := models.FetchPPMShipmentByPPMShipmentID(appCtx.DB(), ppmShipmentId)
+				if err != nil {
+					return handlers.ResponseForError(appCtx.Logger(), err), err
+				}
+				ppmShipmentStatus = ppmShipment.Status
+			}
+
 			if params.OrderID != nil {
 				orderID, _ := uuid.FromString(params.OrderID.String())
 				move, e := models.FetchMoveByOrderID(appCtx.DB(), orderID)
@@ -157,8 +168,8 @@ func (h DeleteUploadHandler) Handle(params uploadop.DeleteUploadParams) middlewa
 				appCtx.Logger().Error("error retrieving move associated with this upload", zap.Error(err))
 			}
 
-			//If move status is not DRAFT, upload cannot be deleted
-			if *uploadInformation.MoveStatus != models.MoveStatusDRAFT {
+			//If move status is not DRAFT and customer is not uploading ppm docs, upload cannot be deleted
+			if (*uploadInformation.MoveStatus != models.MoveStatusDRAFT) && (ppmShipmentStatus != models.PPMShipmentStatusWaitingOnCustomer) {
 				return uploadop.NewDeleteUploadForbidden(), fmt.Errorf("deletion not permitted Move is not in 'DRAFT' status")
 			}
 

src/pages/MyMove/PPM/Closeout/Expenses/Expenses.jsx

@@ -87,7 +87,7 @@ const Expenses = () => {
   };
 
   const handleUploadDelete = (uploadId, fieldName, setFieldTouched, setFieldValue) => {
-    deleteUpload(uploadId)
+    deleteUpload(uploadId, null, mtoShipment?.ppmShipment?.id)
       .then(() => {
         const filteredUploads = mtoShipment.ppmShipment.movingExpenses[currentIndex][fieldName].uploads.filter(
           (upload) => upload.id !== uploadId,

src/pages/MyMove/PPM/Closeout/ProGear/ProGear.jsx

@@ -96,7 +96,7 @@ const ProGear = () => {
   };
 
   const handleUploadDelete = (uploadId, fieldName, setFieldTouched, setFieldValue) => {
-    deleteUpload(uploadId)
+    deleteUpload(uploadId, null, mtoShipment?.ppmShipment?.id)
       .then(() => {
         const filteredUploads = mtoShipment.ppmShipment.proGearWeightTickets[currentIndex][fieldName].uploads.filter(
           (upload) => upload.id !== uploadId,

src/pages/MyMove/PPM/Closeout/WeightTickets/WeightTickets.jsx

@@ -93,7 +93,7 @@ const WeightTickets = () => {
   };
 
   const handleUploadDelete = (uploadId, fieldName, setFieldTouched, setFieldValue) => {
-    deleteUpload(uploadId)
+    deleteUpload(uploadId, null, mtoShipment?.ppmShipment?.id)
       .then(() => {
         const filteredUploads = mtoShipment.ppmShipment.weightTickets[currentIndex][fieldName].uploads.filter(
           (upload) => upload.id !== uploadId,

src/services/internalApi.js

@@ -248,12 +248,13 @@ export async function createUploadForPPMDocument(ppmShipmentId, documentId, file
   );
 }
 
-export async function deleteUpload(uploadId, orderId) {
+export async function deleteUpload(uploadId, orderId, ppmId) {
   return makeInternalRequest(
     'uploads.deleteUpload',
     {
       uploadId,
       orderId,
+      ppmId,
     },
     {
       normalize: false,

swagger-def/internal.yaml

@@ -3075,6 +3075,11 @@ paths:
           type: string
           format: uuid
           description: ID of the order that the upload belongs to
+        - in: query
+          name: ppmId
+          type: string
+          format: uuid
+          description: Optional PPM shipment ID related to the upload
       responses:
         "204":
           description: deleted

swagger/internal.yaml

@@ -4371,6 +4371,11 @@ paths:
           type: string
           format: uuid
           description: ID of the order that the upload belongs to
+        - in: query
+          name: ppmId
+          type: string
+          format: uuid
+          description: Optional PPM shipment ID related to the upload
       responses:
         '204':
           description: deleted