Merge pull request #5107 from alphagov/lock-unlock-actions

Add endpoints to lock and unlock a document

app/controllers/admin/export/document_controller.rb

@@ -1,4 +1,5 @@
 class Admin::Export::DocumentController < Admin::Export::BaseController
+  skip_before_action :verify_authenticity_token
   self.responder = Api::Responder
 
   def show
@@ -16,6 +17,16 @@ def index
     )
   end
 
+  def lock
+    document = Document.find(params[:id])
+    document.update!(locked: true)
+  end
+
+  def unlock
+    document = Document.find(params[:id])
+    document.update!(locked: false)
+  end
+
   private
 
   def paginated_document_ids

config/routes.rb

@@ -189,7 +189,12 @@ def external_redirect(path_prefix, target)
         root to: "dashboard#index", via: :get
 
         namespace "export" do
-          resources :document, only: %i[show index], defaults: { format: :json }
+          resources :document, only: %i[show index], defaults: { format: :json } do
+            member do
+              post :lock
+              post :unlock
+            end
+          end
         end
 
         get "find-in-admin-bookmarklet" => "find_in_admin_bookmarklet#index", as: :find_in_admin_bookmarklet_instructions_index

test/functional/admin/export/document_controller_test.rb

@@ -83,4 +83,36 @@ class Admin::Export::DocumentControllerTest < ActionController::TestCase
 
     assert_equal expected_response, json_response
   end
+
+  test "lock returns forbidden if user does not have export data permission" do
+    login_as :world_editor
+    post :lock, params: { id: "1" }, format: "json"
+    assert_response :forbidden
+  end
+
+  test "locks document" do
+    document = create(:document)
+    login_as :export_data_user
+
+    post :lock, params: { id: document.id }, format: "json"
+
+    assert document.reload.locked
+    assert_response :no_content
+  end
+
+  test "unlock returns forbidden if user does not have export data permission" do
+    login_as :world_editor
+    post :unlock, params: { id: "1" }, format: "json"
+    assert_response :forbidden
+  end
+
+  test "unlocks document" do
+    document = create(:document, locked: true)
+    login_as :export_data_user
+
+    post :unlock, params: { id: document.id }, format: "json"
+
+    refute document.reload.locked
+    assert_response :no_content
+  end
 end