|
46 | 46 | from app.business.errors import BusinessProcessingError |
47 | 47 | from app.datamgmt.manage.manage_cases_db import get_filtered_cases |
48 | 48 | from app.schema.marshables import CaseSchemaForAPIV2 |
49 | | -from app.schema.marshables import CaseSchema |
50 | 49 | from app.blueprints.access_controls import ac_api_requires |
51 | 50 | from app.business.access_controls import ac_fast_check_current_user_has_case_access |
52 | 51 | from app.blueprints.access_controls import ac_api_return_access_denied |
@@ -136,23 +135,22 @@ def update(self, identifier): |
136 | 135 |
|
137 | 136 | request_data = request.get_json() |
138 | 137 |
|
| 138 | + customer_identifier = request_data.get('case_customer_id') |
139 | 139 | # If user tries to update the customer, check if the user has access to the new customer |
140 | | - if request_data.get('case_customer') and request_data.get('case_customer') != case.client_id: |
141 | | - if not user_has_client_access(iris_current_user.id, request_data.get('case_customer')): |
| 140 | + if customer_identifier and customer_identifier != case.client_id: |
| 141 | + if not user_has_client_access(iris_current_user.id, customer_identifier): |
142 | 142 | raise BusinessProcessingError('Invalid customer ID. Permission denied.') |
143 | 143 |
|
144 | 144 | if 'case_name' in request_data: |
145 | 145 | short_case_name = request_data.get('case_name').replace(f'#{case.case_id} - ', '') |
146 | 146 | request_data['case_name'] = f'#{case.case_id} - {short_case_name}' |
147 | | - request_data['case_customer'] = case.client_id if not request_data.get( |
148 | | - 'case_customer') else request_data.get( |
149 | | - 'case_customer') |
150 | | - request_data['reviewer_id'] = None if request_data.get('reviewer_id') == '' else request_data.get( |
151 | | - 'reviewer_id') |
152 | | - |
153 | | - # TODO should use self._schema! |
154 | | - add_case_schema = CaseSchema() |
155 | | - updated_case = add_case_schema.load(request_data, instance=case, partial=True) |
| 147 | + if not customer_identifier: |
| 148 | + request_data['case_customer_id'] = case.client_id |
| 149 | + reviewer_identifier = request_data.get('reviewer_id') |
| 150 | + if reviewer_identifier == '': |
| 151 | + request_data['reviewer_id'] = None |
| 152 | + |
| 153 | + updated_case = self._schema.load(request_data, instance=case, partial=True) |
156 | 154 |
|
157 | 155 | protagonists = request_data.get('protagonists') |
158 | 156 | tags = request_data.get('case_tags') |
|
0 commit comments