From 49b6ae5f41c587418ed4a438de193c8411f4f5f9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pawe=C5=82=20Srokosz?= <pawel.srokosz@cert.pl>
Date: Wed, 21 Feb 2024 16:51:32 +0100
Subject: [PATCH] Fix: deleting user that authored some comments (#913)

---
 mwdb/model/user.py        |  5 ++++-
 mwdb/schema/comment.py    |  2 +-
 tests/backend/test_api.py | 19 +++++++++++++++++++
 3 files changed, 24 insertions(+), 2 deletions(-)

diff --git a/mwdb/model/user.py b/mwdb/model/user.py
index e4efc00fc..66bc8f189 100644
--- a/mwdb/model/user.py
+++ b/mwdb/model/user.py
@@ -65,7 +65,10 @@ class User(db.Model):
     )
 
     commented_objects = db.relationship(
-        "Object", secondary="comment", back_populates="comment_authors"
+        "Object",
+        secondary="comment",
+        back_populates="comment_authors",
+        passive_deletes=True,
     )
 
     comments = db.relationship(
diff --git a/mwdb/schema/comment.py b/mwdb/schema/comment.py
index f57c6fad9..c301ae66c 100644
--- a/mwdb/schema/comment.py
+++ b/mwdb/schema/comment.py
@@ -18,5 +18,5 @@ class CommentRequestSchema(CommentSchemaBase):
 
 class CommentItemResponseSchema(CommentSchemaBase):
     id = fields.Int(required=True, allow_none=False)
-    author = fields.Str(required=True, allow_none=False, attribute="author_login")
+    author = fields.Str(required=True, default=None, attribute="author_login")
     timestamp = UTCDateTime(required=True, allow_none=False)
diff --git a/tests/backend/test_api.py b/tests/backend/test_api.py
index 13c5d4e41..3232a489b 100644
--- a/tests/backend/test_api.py
+++ b/tests/backend/test_api.py
@@ -2,6 +2,7 @@
 import requests
 from dateutil.parser import parse
 
+from .relations import RelationTestCase
 from .utils import rand_string, ShouldRaise
 
 
@@ -229,3 +230,21 @@ def test_zero_starting_crc32(admin_session):
     content = b'\xf7\xb8\xb4\xab\x6b\x35\x31\x8a'
     sample = admin_session.add_sample(name, content)
     assert sample["crc32"] == "000d06ec"
+
+
+def test_user_delete(admin_session):
+    # Make user and use it to comment new sample
+    case = RelationTestCase(admin_session)
+    alice = case.new_user("Alice", capabilities=["adding_comments"])
+    sample = case.new_sample("Sample")
+    sample.create(alice)
+    alice.session.add_comment(sample.dhash, "random comment")
+    # Then try to remove that user
+    admin_session.remove_user(alice.identity)
+    # Object should be still reachable
+    admin_session.get_sample(sample.dhash)
+    # And should still have one comment (with nulled author)
+    comments = admin_session.get_comments(sample.dhash)
+    assert len(comments) == 1
+    assert comments[0]["comment"] == "random comment"
+    assert comments[0]["author"] is None