Merge pull request #3870 from alephdata/resolve-merge-conflicts

Merge main into release/4.0.0

.github/workflows/build.yml

@@ -34,6 +34,8 @@ jobs:
 
       - name: Install development dependencies
         run: make dev
+        env:
+          PIP_BREAK_SYSTEM_PACKAGES: 1
 
       - name: Check code formatting
         run: make format-check

.github/workflows/e2e.yml

@@ -39,6 +39,12 @@ jobs:
       - name: Pull and start services
         run: make services-e2e
 
+      - name: Build e2e image
+        run: make build-e2e
+
+      - name: Pull and start services
+        run: make services-e2e
+
       - name: Run tests
         run: make e2e
 

.github/workflows/pr.yml

@@ -15,6 +15,8 @@ jobs:
 
       - name: Install development dependencies
         run: make dev
+        env:
+          PIP_BREAK_SYSTEM_PACKAGES: 1
 
       - name: Check code formatting
         run: make format-check

aleph/logic/html.py

@@ -1,4 +1,5 @@
 import logging
+from html import escape
 from lxml import html
 from lxml.etree import tostring
 from lxml.html.clean import Cleaner
@@ -65,6 +66,10 @@ def sanitize_html(html_text, base_url, encoding=None):
 
 def html_link(text, link):
     text = text or "[untitled]"
+    text = escape(text)
+
     if link is None:
-        return "<span class='reference'>%s</span>" % text
-    return "<a class='reference' href='%s'>%s</a>" % (link, text)
+        return f"<span class='reference'>{text}</span>"
+
+    link = escape(link)
+    return f"<a class='reference' href='{link}'>{text}</a>"

aleph/model/collection.py

@@ -237,6 +237,16 @@ def all_by_secret(cls, secret, authz=None):
     def create(cls, data, authz, created_at=None):
         foreign_id = data.get("foreign_id") or make_textid()
         collection = cls.by_foreign_id(foreign_id, deleted=True)
+
+        # A collection with the given foreign ID already exists
+        if collection and not collection.deleted_at:
+            raise ValueError("Invalid foreign_id")
+
+        # A deleted collection with the foreign ID already exists, but the deleted
+        # collection was created by a different role
+        if collection and collection.creator_id != authz.role.id:
+            raise ValueError("Invalid foreign_id")
+
         if collection is None:
             collection = cls()
             collection.created_at = created_at

aleph/tests/test_collections_api.py

@@ -107,6 +107,41 @@ def test_update_valid(self):
         assert "Collected" in res.json["label"], res.json
         assert validate(res.json, "Collection")
 
+    def test_create_foreign_id(self):
+        role, headers = self.login()
+        _, headers_other = self.login(foreign_id="other")
+        collection = self.create_collection(foreign_id="foo", label="foo", creator=role)
+
+        url = "/api/2/collections"
+        data = {"foreign_id": "foo", "label": "bar"}
+
+        res = self.client.post(url, json=data, headers=headers_other)
+        assert res.status_code == 400
+
+        res = self.client.post(url, json=data, headers=headers)
+        assert res.status_code == 400
+
+        # Sanity check: The collection label is still the original one
+        collection_url = f"/api/2/collections/{collection.id}"
+        res = self.client.get(collection_url, headers=headers)
+        assert res.json["foreign_id"] == "foo"
+        assert res.json["label"] == "foo"
+
+        # After deleting the collection, a new collection with the foreign ID
+        # can be created by the creator of the original collection
+        res = self.client.delete(collection_url, headers=headers)
+        assert res.status_code == 204
+
+        res = self.client.post(url, json=data, headers=headers_other)
+        assert res.status_code == 400
+
+        res = self.client.post(url, json=data, headers=headers)
+        assert res.status_code == 200
+
+        res = self.client.get(collection_url, headers=headers)
+        assert res.json["foreign_id"] == "foo"
+        assert res.json["label"] == "bar"
+
     def test_update_no_label(self):
         _, headers = self.login(is_admin=True)
         url = "/api/2/collections/%s" % self.col.id