API to Link an EngagementQuestionnaire's unanswered Answered_Survey to an Engagement

[hblankenship]

[sc-6273]

Links a questionnaire with an engagement in the API, creating the Answered_Survey and returning it as response.

This new endpoint located at /api/v2/questionnaire_engagement_questionnaires/{id}/link_engagement/{engagement_id}

[dryrunsecurity]

DryRun Security Summary

The pull request focuses on improving the security and functionality of the QuestionnaireEngagementSurveyViewSet class and adding a new test case to the AnsweredSurveyTest class, with the goal of safely linking an engagement survey to an engagement.

Expand for full summary

Summary:

The code changes in this pull request appear to be focused on improving the security and functionality of the QuestionnaireEngagementSurveyViewSet class in the dojo/api_v2/views.py file, as well as adding a new test case to the AnsweredSurveyTest class in the unittests/test_rest_framework.py file.

The changes to the QuestionnaireEngagementSurveyViewSet class introduce a new link_engagement action method that safely retrieves the Engagement object and links it to the Engagement_Survey object. This implementation uses best practices such as get_object_or_404 and get_or_create to handle potential security and data integrity issues.

The new test case added to the AnsweredSurveyTest class tests the functionality of linking an engagement survey to an engagement. While this is a positive step, the code should be reviewed to ensure that the user input is properly sanitized and validated, and that the necessary permissions and authorization checks are in place to prevent potential security vulnerabilities.

Files Changed:

1. dojo/api_v2/views.py:

   • The changes introduce a new link_engagement action method in the QuestionnaireEngagementSurveyViewSet class.
   • The method safely retrieves the Engagement object using get_object_or_404 and links it to the Engagement_Survey object using get_or_create.
   • The response is serialized using the QuestionnaireAnsweredSurveySerializer, ensuring that only the necessary data is returned to the client.

2. unittests/test_rest_framework.py:

   • A new test case test_link_engagement_questionnaire() has been added to the AnsweredSurveyTest class.
   • The test case performs a POST request to the link_engagement/2/ endpoint, which suggests that this operation requires specific permissions or authorization.
   • The code should be reviewed to ensure that the user input is properly sanitized and validated, and that the necessary permissions and authorization checks are in place to prevent potential security vulnerabilities.

Code Analysis

We ran 9 analyzers against 2 files and 0 analyzers had findings. 9 analyzers had no findings.

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.

[mtesauro]

Approved