Fix ietf-tools#2277 - Do not allow reviewers to reject overdue reviews.

If a review request is past the deadline, reviewers will no longer be
able to reject the assignment.

Commit ready for merge.
 - Legacy-Id: 16883

Author: Sasha Romijn

ietf/doc/tests_review.py

@@ -473,6 +473,8 @@ def test_reject_reviewer_assignment(self):
         r = self.client.get(reject_url)
         self.assertEqual(r.status_code, 200)
         self.assertContains(r, str(assignment.reviewer.person))
+        self.assertNotContains(r, 'can not be rejected')
+        self.assertContains(r, '<button type="submit"')
 
         # reject
         empty_outbox()
@@ -489,6 +491,28 @@ def test_reject_reviewer_assignment(self):
         self.assertFalse("<reviewsecretary@example.com>" in outbox[0]["To"])
         self.assertTrue("Test message" in outbox[0].get_payload(decode=True).decode("utf-8"))
 
+        # try again, but now with an expired review request, which should not be allowed (#2277)
+        assignment.state_id = 'assigned'
+        assignment.save()
+        review_req.deadline = datetime.date(2019, 1, 1)
+        review_req.save()
+        
+        r = self.client.get(reject_url)
+        self.assertEqual(r.status_code, 200)
+        self.assertContains(r, str(assignment.reviewer.person))
+        self.assertContains(r, 'can not be rejected')
+        self.assertNotContains(r, '<button type="submit"')
+
+        # even though the form is not visible, try posting to the URL, which should not work
+        empty_outbox()
+        r = self.client.post(reject_url, { "action": "reject", "message_to_secretary": "Test message" })
+        self.assertEqual(r.status_code, 200)
+        self.assertContains(r, 'can not be rejected')
+
+        assignment = reload_db_objects(assignment)
+        self.assertEqual(assignment.state_id, "assigned")
+        self.assertEqual(len(outbox), 0)
+
     def make_test_mbox_tarball(self, review_req):
         mbox_path = os.path.join(self.review_dir, "testmbox.tar.gz")
         with tarfile.open(mbox_path, "w:gz") as tar:

ietf/doc/views_review.py

@@ -320,6 +320,7 @@ class RejectReviewerAssignmentForm(forms.Form):
 def reject_reviewer_assignment(request, name, assignment_id):
     doc = get_object_or_404(Document, name=name)
     review_assignment = get_object_or_404(ReviewAssignment, pk=assignment_id, state__in=["assigned", "accepted"])
+    review_request_past_deadline = review_assignment.review_request.deadline < datetime.date.today()
 
     if not review_assignment.reviewer:
         return redirect(review_request, name=review_assignment.review_request.doc.name, request_id=review_assignment.review_request.pk)
@@ -330,7 +331,7 @@ def reject_reviewer_assignment(request, name, assignment_id):
     if not (is_reviewer or can_manage_request):
         return HttpResponseForbidden("You do not have permission to perform this action")
 
-    if request.method == "POST" and request.POST.get("action") == "reject":
+    if request.method == "POST" and request.POST.get("action") == "reject" and not review_request_past_deadline:
         form = RejectReviewerAssignmentForm(request.POST)
         if form.is_valid():
             # reject the assignment
@@ -367,6 +368,7 @@ def reject_reviewer_assignment(request, name, assignment_id):
         'review_req': review_assignment.review_request,
         'assignments': review_assignment.review_request.reviewassignment_set.all(),
         'form': form,
+        'review_request_past_deadline': review_request_past_deadline,
     })
 
 @login_required

ietf/templates/doc/review/reject_reviewer_assignment.html

@@ -10,17 +10,23 @@ <h1>Reject review assignment<br><small>{{ review_req.doc.name }}</small></h1>
 
   {% include "doc/review/request_info.html" %}
 
-  <p>Do you want to reject this assignment?</p>
-
-  <form method="post">
-    {% csrf_token %}
-
-    {% bootstrap_form form %}
-
-    {% buttons %}
-    <a class="btn btn-default" href="{% url "ietf.doc.views_review.review_request" name=doc.canonical_name request_id=review_req.pk %}">Cancel</a>
-    <button type="submit" class="btn btn-primary" name="action" value="reject">Reject assignment</button>
-    {% endbuttons %}
-  </form>
+  {% if not review_request_past_deadline %}
+    <p>Do you want to reject this assignment?</p>
+
+    <form method="post">
+      {% csrf_token %}
+
+      {% bootstrap_form form %}
+
+      {% buttons %}
+      <a class="btn btn-default" href="{% url "ietf.doc.views_review.review_request" name=doc.canonical_name request_id=review_req.pk %}">Cancel</a>
+      <button type="submit" class="btn btn-primary" name="action" value="reject">Reject assignment</button>
+      {% endbuttons %}
+    </form>
+  {% else %}
+    <p class="alert alert-info">
+      This review assignment can not be rejected, as the deadline of the review request has already passed.
+    </p>
+  {% endif %}
 
 {% endblock %}