Journalist API: Only show pending=False sources

Sources should only be exposed to journalists when they
have submitted something

securedrop/journalist_app/api.py

@@ -101,7 +101,7 @@ def get_token():
     @api.route('/sources', methods=['GET'])
     @token_required
     def get_all_sources():
-        sources = Source.query.all()
+        sources = Source.query.filter_by(pending=False).all()
         return jsonify(
             {'sources': [source.to_json() for source in sources]}), 200
 

securedrop/tests/test_journalist_api.py

@@ -119,7 +119,7 @@ def test_user_cannot_get_an_api_token_with_no_otp_field(journalist_app,
         assert observed_response['message'] == 'one_time_code field is missing'
 
 
-def test_authorized_user_gets_all_sources(journalist_app, test_source,
+def test_authorized_user_gets_all_sources(journalist_app, test_submissions,
                                           journalist_api_token):
     with journalist_app.test_client() as app:
         response = app.get(url_for('api.get_all_sources'),
@@ -130,7 +130,7 @@ def test_authorized_user_gets_all_sources(journalist_app, test_source,
         assert response.status_code == 200
 
         # We expect to see our test source in the response
-        assert test_source['source'].journalist_designation == \
+        assert test_submissions['source'].journalist_designation == \
             data['sources'][0]['journalist_designation']
 
 

securedrop/tests/utils/db_helper.py

@@ -146,6 +146,7 @@ def submit(source, num_submissions):
     submissions = []
     for _ in range(num_submissions):
         source.interaction_count += 1
+        source.pending = False
         fpath = current_app.storage.save_message_submission(
             source.filesystem_id,
             source.interaction_count,
@@ -154,6 +155,7 @@ def submit(source, num_submissions):
         )
         submission = models.Submission(source, fpath)
         submissions.append(submission)
+        db.session.add(source)
         db.session.add(submission)
 
     db.session.commit()