From a4899dbc76d2630d7aa26cad9d8716008d022223 Mon Sep 17 00:00:00 2001
From: MelodyZhangYiqun <yiqunz@andrew.cmu.edu>
Date: Sat, 10 Dec 2022 14:46:53 -0500
Subject: [PATCH] Do not allow bill edit when payer is deactivated

---
 ihatemoney/tests/main_test.py | 91 ++++++++++++++++++++++++++++++++++-
 ihatemoney/web.py             |  7 +++
 2 files changed, 96 insertions(+), 2 deletions(-)

diff --git a/ihatemoney/tests/main_test.py b/ihatemoney/tests/main_test.py
index 843385f92..41fc1c49a 100644
--- a/ihatemoney/tests/main_test.py
+++ b/ihatemoney/tests/main_test.py
@@ -3,6 +3,7 @@
 import socket
 from unittest.mock import MagicMock, patch
 
+from flask import url_for
 import pytest
 from sqlalchemy import orm
 from werkzeug.security import check_password_hash
@@ -166,6 +167,91 @@ def test_weighted_bills(self):
                 pay_each_expected = 10 / 3
                 assert bill.amount / weight == pay_each_expected
 
+    def test_remove_member(self):
+        # make project
+        self.post_project("raclette")
+
+        # add members
+        self.client.post("/raclette/members/add", data={"name": "zorglub", "weight": 2})
+        self.client.post("/raclette/members/add", data={"name": "fred"})
+        self.client.post("/raclette/members/add", data={"name": "tata"})
+
+        # make bills
+        self.client.post(
+            "/raclette/add",
+            data={
+                "date": "2011-08-10",
+                "what": "red wine",
+                "payer": 1,
+                "payed_for": [2],
+                "amount": "20",
+            },
+        )
+
+        project = models.Project.query.get_by_name(name="raclette")
+
+        zorglub = models.Person.query.get_by_name(name="zorglub", project=project)
+        tata = models.Person.query.get_by_name(name="tata", project=project)
+        fred = models.Person.query.get_by_name(name="fred", project=project)
+
+        project.remove_member(tata.id)
+        # tata should be fully removed because they are not connected to a bill
+        assert project.members == [zorglub, fred]
+
+        project.remove_member(zorglub.id)
+
+        # zorglub is connected to a bill so they should be deactivated
+        assert project.members == [zorglub, fred]
+        assert not zorglub.activated
+
+    def test_deactivated_user_bill(self):
+        self.post_project("raclette")
+
+        # add members
+        self.client.post("/raclette/members/add", data={"name": "zorglub", "weight": 2})
+        self.client.post("/raclette/members/add", data={"name": "fred"})
+        self.client.post("/raclette/members/add", data={"name": "tata"})
+
+        project = models.Project.query.get_by_name(name="raclette")
+        zorglub = models.Person.query.get_by_name(name="zorglub", project=project)
+
+        self.client.post(
+            "/raclette/add",
+            data={
+                "date": "2011-08-10",
+                "what": "red wine",
+                "payer": 1,
+                "payed_for": [2],
+                "amount": "20",
+            },
+        )
+
+        project.remove_member(zorglub.id)
+
+        self.client.post(
+            "/raclette/edit",
+            data={
+                "date": "2011-08-10",
+                "what": "red wine",
+                "payer": 1,
+                "payed_for": [2],
+                "amount": "30",
+            },
+        )
+
+        zorglub_bill = models.Bill.query.options(
+            orm.subqueryload(models.Bill.owers)
+        ).filter(models.Bill.owers.contains(zorglub))
+
+        for bill in zorglub_bill:
+            id = bill.id
+            resp = self.client.post("/<raclette/edit/" + str(id), follow_redirects=True)
+            self.assertEqual(resp.status_code, 200)
+            assert resp.path == url_for(".list_bills")
+
+        # user edits a form, redirect + error should occur
+        # Check that we were redirected to the list of bills page
+
     def test_bill_pay_each(self):
         self.post_project("raclette")
 
@@ -401,8 +487,9 @@ def test_exchange_currency(self):
 
     def test_failing_remote(self):
         rates = {}
-        with patch("requests.Response.json", new=lambda _: {}), pytest.warns(
-            UserWarning
+        with (
+            patch("requests.Response.json", new=lambda _: {}),
+            pytest.warns(UserWarning),
         ):
             # we need a non-patched converter, but it seems that MagickMock
             # is mocking EVERY instance of the class method. Too bad.
diff --git a/ihatemoney/web.py b/ihatemoney/web.py
index 0d0bdd201..98ed65a8a 100644
--- a/ihatemoney/web.py
+++ b/ihatemoney/web.py
@@ -8,6 +8,7 @@
 some shortcuts to make your life better when coding (see `pull_project`
 and `add_project_id` for a quick overview)
 """
+
 import datetime
 from functools import wraps
 import hashlib
@@ -813,6 +814,12 @@ def edit_bill(bill_id):
     bill = Bill.query.get(g.project, bill_id)
     if not bill:
         raise NotFound()
+    payer_id = bill.payer_id
+    payer = Person.query.get(payer_id)
+
+    if not payer.activated:
+        flash(_("The payer is deactivated. You cannot edit the bill."))
+        return redirect(url_for(".list_bills"))
 
     form = get_billform_for(g.project, set_default=False)