Merge pull request #61 from gorserg/fix_status_changes

Контролювання переходів між статусами.

openprocurement/tender/competitivedialogue/tests/stage1/bid.py

@@ -171,6 +171,50 @@ def test_create_tender_bidder_invalid(self):
             {u'description': [u'currency of bid should be identical to currency of value of tender'], u'location': u'body', u'name': u'value'},
         ])
 
+    def test_status_jumping(self):
+        """ Owner try set active.stage2.waiting status after pre-qualification """
+        response = self.app.post_json('/tenders/{}/bids'.format(self.tender_id),
+                                      {'data': {'selfEligible': True, 'selfQualified': True,
+                                                'tenderers': test_bids[0]['tenderers'], "value": {"amount": 500}}})
+        self.assertEqual(response.status, '201 Created')
+        self.assertEqual(response.content_type, 'application/json')
+        bid = response.json['data']
+        bid_token = response.json['access']['token']
+        response = self.app.post_json('/tenders/{}/bids'.format(self.tender_id),
+                                      {'data': {'selfEligible': True, 'selfQualified': True,
+                                                'tenderers': test_bids[1]['tenderers'], "value": {"amount": 499}}})
+
+        response = self.app.post_json('/tenders/{}/bids'.format(self.tender_id),
+                                      {'data': {'selfEligible': True, 'selfQualified': True,
+                                                'tenderers': test_bids[1]['tenderers'], "value": {"amount": 499}}})
+
+        response = self.app.get('/tenders/{}/bids/{}'.format(self.tender_id, bid['id']), status=403)
+        self.assertEqual(response.status, '403 Forbidden')
+        self.assertEqual(response.content_type, 'application/json')
+        self.assertEqual(response.json['errors'][0]["description"],
+                         "Can't view bid in current (active.tendering) tender status")
+
+        response = self.app.get('/tenders/{}/bids/{}?acc_token={}'.format(self.tender_id, bid['id'], bid_token))
+        self.assertEqual(response.status, '200 OK')
+        self.assertEqual(response.content_type, 'application/json')
+        self.assertEqual(response.json['data'], bid)
+
+        # switch to active.pre-qualification
+        self.set_status('active.pre-qualification', {"id": self.tender_id, 'status': 'active.tendering'})
+        self.app.authorization = ('Basic', ('chronograph', ''))
+        response = self.app.patch_json('/tenders/{}'.format(self.tender_id), {"data": {"id": self.tender_id}})
+        self.assertEqual(response.json['data']['status'], 'active.pre-qualification')
+
+        self.app.authorization = ('Basic', ('broker', ''))
+
+        response = self.app.patch_json('/tenders/{}?acc_token={}'.format(self.tender_id, self.tender_token),
+                                       {'data': {'status': 'active.stage2.waiting'}},
+                                       status=403)
+        self.assertEqual(response.status, '403 Forbidden')
+        self.assertEqual(response.content_type, 'application/json')
+        self.assertEqual(response.json['errors'][0]["description"],
+                         "Can't update tender status")
+
     def test_create_tender_bidder(self):
         """ Test create dialog bdder """
         # Create bid,

openprocurement/tender/competitivedialogue/utils.py

@@ -114,6 +114,12 @@ def patch_eu(self):
             self.request.errors.add('body', 'data', 'Can\'t switch to \'active.pre-qualification.stand-still\' while not all bids are qualified')
             self.request.errors.status = 403
             return
+    elif self.request.authenticated_role == 'tender_owner' and \
+            self.request.validated['tender_status'] == 'active.pre-qualification' and \
+            tender.status != "active.pre-qualification.stand-still":
+        self.request.errors.add('body', 'data', 'Can\'t update tender status')
+        self.request.errors.status = 403
+        return
 
     save_tender(self.request)
     self.LOGGER.info('Updated tender {}'.format(tender.id),