Merge branch 'hotfix/25.14.1'

Author: adlius

api/preprints/permissions.py

@@ -2,6 +2,7 @@
 from rest_framework import exceptions
 
 from api.base.utils import get_user_auth, assert_resource_type
+from api.base.exceptions import Conflict
 from api.nodes.permissions import (
     AdminOrPublic as NodeAdminOrPublic,
 )
@@ -164,3 +165,25 @@ def has_object_permission(self, request, view, obj):
             return False
         else:
             return obj.has_permission(auth.user, osf_permissions.READ)
+
+
+class CanSubmitPreprintToProvider(permissions.BasePermission):
+
+    def has_permission(self, request, view):
+        if request.method != 'POST':
+            return True
+
+        provider_id = request.data.get('provider', None)
+        if not provider_id:
+            return False
+
+        from osf.models import PreprintProvider
+        try:
+            provider = PreprintProvider.objects.get(_id=provider_id)
+        except PreprintProvider.DoesNotExist:
+            return False
+
+        if not provider.allow_submissions:
+            raise Conflict(f"Provider {provider.name} doesn't allow new submissions.")
+
+        return True

api/preprints/serializers.py

@@ -507,7 +507,6 @@ class PreprintCreateSerializer(PreprintSerializer):
     manual_doi = ser.CharField(write_only=True, required=False, allow_null=True, allow_blank=True)
 
     def create(self, validated_data):
-
         creator = self.context['request'].user
         provider = validated_data.pop('provider', None)
         if not provider:

api/preprints/views.py

@@ -62,6 +62,7 @@
     ContributorDetailPermissions,
     PreprintFilesPermissions,
     PreprintInstitutionPermissionList,
+    CanSubmitPreprintToProvider,
 )
 from api.providers.workflows import Workflows, PUBLIC_STATES
 from api.nodes.permissions import ContributorOrPublic
@@ -169,6 +170,7 @@ class PreprintList(PreprintMetricsViewMixin, JSONAPIBaseView, generics.ListCreat
         drf_permissions.IsAuthenticatedOrReadOnly,
         base_permissions.TokenHasScope,
         ContributorOrPublic,
+        CanSubmitPreprintToProvider,
     )
 
     parser_classes = (JSONAPIMultipleRelationshipsParser, JSONAPIMultipleRelationshipsParserForRegularJSON)

api_tests/preprints/views/test_preprint_list.py

@@ -510,16 +510,22 @@ def test_no_provider_given(self):
         no_providers_payload = build_preprint_create_payload()
         res = self.app.post_json_api(self.url, no_providers_payload, auth=self.user.auth, expect_errors=True)
 
-        assert res.status_code == 400
-        assert res.json['errors'][0]['detail'] == 'You must specify a valid provider to create a preprint.'
+        assert res.status_code == 403
 
     def test_invalid_provider_given(self):
         wrong_provider_payload = build_preprint_create_payload(provider_id='jobbers')
 
         res = self.app.post_json_api(self.url, wrong_provider_payload, auth=self.user.auth, expect_errors=True)
 
-        assert res.status_code == 400
-        assert res.json['errors'][0]['detail'] == 'You must specify a valid provider to create a preprint.'
+        assert res.status_code == 403
+
+    def test_submission_to_provider_not_allowed(self):
+        provider = PreprintProviderFactory(allow_submissions=False)
+        public_project_payload = build_preprint_create_payload(provider_id=provider._id)
+        res = self.app.post_json_api(self.url, public_project_payload, auth=self.user.auth, expect_errors=True)
+
+        assert res.status_code == 409
+        assert res.json['errors'][0]['detail'] == f'Provider {provider.name} doesn\'t allow new submissions.'
 
     def test_file_not_osfstorage(self):
         public_project_payload = build_preprint_create_payload(provider_id=self.provider._id)