fix: address Copilot review comments from PR #412

[chrisdoehring]

Summary

Addresses three Copilot review comments on #412 (release-20260508 → main). Merges into release-20260508 so the fixes flow into #412 automatically.

1. Scope id lookup to the integration (was a 500/leak risk)

IntegrationConfiguration.objects.get(id=...) in validate() wasn't scoped to the integration being patched.

• Nonexistent id → DoesNotExist → unhandled 500.
• Id belonging to a different integration → accepted, then later repointed by update_or_create's defaults (i.e., one integration could mutate another's config row).

Fix: scope to self.instance.configurations and raise a clean 400 with "Configuration '...' was not found on this integration.".

2. Freeze action on id-updates

update() was passing the full config_data (including any payload action) as defaults to update_or_create. When id was present, that could repoint the row's action — colliding with the (integration, action) UniqueConstraint and bypassing the schema validation in validate() (which keyed off the existing action).

Fix: pop action from defaults when id is present. The portal sometimes echoes action back for client convenience — it's now correctly ignored on id-updates.

3. Tighten test assertions

Replaced assert "..." in str(response.json()) with assert "..." in response.json()["non_field_errors"][0].

Test plan

• test_patch_integration_config_rejects_unknown_config_id — bogus id → 400 (not 500)
• test_patch_integration_config_rejects_id_from_different_integration — id from another integration → 400, original config untouched
• test_patch_integration_config_ignores_action_on_id_update — payload action alongside id is ignored; row's action stays put
• All 18 integration-config tests pass (pytest -k "config or create_er or create_lotek or test_update_or_create or rejects_* or ignores_*")

Related

• Parent PR: Release 20260508 hotfix #412 (release-20260508 → main)
• Hotfix PR: fix: PATCH /v2/integrations/ rejects nested configurations (GUNDI-5313) #411 (already merged into release-20260508)
• Jira: GUNDI-5313

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR addresses follow-up Copilot review items from PR #412 by tightening nested integration-configuration PATCH behavior: it scopes configuration id lookups to the integration being updated, prevents action from being mutated on id-based updates, and strengthens test assertions to check structured error payloads.

Changes:

• Scope configuration id validation to self.instance.configurations and return a clean 400 when the id is missing or belongs to a different integration.
• Ignore payload action when updating configurations by id to prevent action-repointing and (integration, action) uniqueness collisions.
• Update/add tests to cover unknown ids, cross-integration ids, and “ignore action on id update”, and tighten error assertions to non_field_errors[0].

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
cdip_admin/api/v2/serializers.py	Scopes config-id lookup to the integration; ignores action in defaults for id-based updates.
cdip_admin/api/v2/tests/test_integrations_api.py	Adds regression tests for scoped id validation and immutable action-on-id-update; tightens error assertions.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.