[FIX] vault: do not present exhausted inboxes as writable

An inbox that can no longer be written to (access counter at 0 or
expired) still showed its writable inbox link, and submitting to it
silently did nothing while the form reported 'Successfully stored'.
This is misleading for received/delivered secrets which are created
with accesses = 0.

- Add a computed 'writable' flag (accesses left and not expired) and
  hide the inbox link in the list and form views when it is not
  writable.
- Make the controller report 'This link is no longer active' when
  store_in_inbox performs no write instead of a false success message.
- Cover the exhausted-inbox submit path in the controller test.

Author: jans23

vault/controllers/main.py

@@ -59,7 +59,7 @@ def vault_inbox(self, token):
             return request.render("vault.inbox", ctx)
 
         try:
-            inbox.store_in_inbox(
+            result = inbox.store_in_inbox(
                 name,
                 secret,
                 secret_file,
@@ -76,6 +76,10 @@ def vault_inbox(self, token):
             )
             return request.render("vault.inbox", ctx)
 
+        if not result:
+            ctx["error"] = _("This link is no longer active")
+            return request.render("vault.inbox", ctx)
+
         ctx["message"] = _("Successfully stored")
         return request.render("vault.inbox", ctx)
 

vault/models/vault_inbox.py

@@ -43,6 +43,7 @@ class VaultInbox(models.Model):
         help="If expired the inbox can't be written using the link",
     )
     log_ids = fields.One2many("vault.inbox.log", "inbox_id", "Log", readonly=True)
+    writable = fields.Boolean(compute="_compute_writable")
 
     _sql_constraints = [
         (
@@ -52,6 +53,14 @@ class VaultInbox(models.Model):
         ),
     ]
 
+    @api.depends("accesses", "expiration")
+    def _compute_writable(self):
+        now = datetime.now()
+        for rec in self:
+            rec.writable = rec.accesses > 0 and (
+                not rec.expiration or now < rec.expiration
+            )
+
     @api.depends("token")
     def _compute_inbox_link(self):
         base_url = self.env["ir.config_parameter"].sudo().get_param("web.base.url")

vault/tests/test_controller.py

@@ -108,6 +108,20 @@ def load(response):
             self.assertEqual(self.inbox.secret, "secret")
             self.assertEqual(self.inbox.secret_file, b"file")
 
+            exhausted = self.env["vault.inbox"].create(
+                {
+                    "user_id": self.user.id,
+                    "name": "Exhausted",
+                    "key": "4",
+                    "iv": "1",
+                    "secret": "kept secret",
+                    "accesses": 0,
+                }
+            )
+            response = load(self.controller.vault_inbox(exhausted.token))
+            self.assertEqual(response["error"], "This link is no longer active")
+            self.assertEqual(exhausted.secret, "kept secret")
+
             # Test a duplicate inbox
             self.inbox.copy().token = self.inbox.token
             response = load(self.controller.vault_inbox(self.inbox.token))

vault/tests/test_inbox.py

@@ -72,6 +72,32 @@ def test_inbox(self):
         self.assertEqual(inbox, model.find_inbox(inbox.token))
         self.assertEqual(model, model.find_inbox(uuid4()))
 
+    def test_writable(self):
+        model = self.env["vault.inbox"]
+        user = self.env.user
+        inbox = model.store_in_inbox(
+            name=f"Inbox {user.name}",
+            secret="secret",
+            iv="iv",
+            user=user,
+            key="key",
+            secret_file="",
+            filename="",
+        )
+
+        inbox.accesses = 5
+        self.assertTrue(inbox.writable)
+
+        inbox.accesses = 0
+        self.assertFalse(inbox.writable)
+
+        inbox.accesses = 5
+        inbox.expiration = datetime(1970, 1, 1)
+        self.assertFalse(inbox.writable)
+
+        inbox.expiration = False
+        self.assertTrue(inbox.writable)
+
     def test_send_wizard(self):
         user = self.env.user
         wiz = self.env["vault.send.wizard"].create(

vault/views/vault_inbox_views.xml

@@ -4,8 +4,9 @@
         <field name="model">vault.inbox</field>
         <field name="arch" type="xml">
             <list create="false">
+                <field name="writable" column_invisible="1" />
                 <field name="name" />
-                <field name="inbox_link" widget="url" />
+                <field name="inbox_link" widget="url" invisible="not writable" />
             </list>
         </field>
     </record>
@@ -19,8 +20,13 @@
                     <field name="iv" invisible="1" />
                     <field name="key" invisible="1" />
                     <field name="filename" invisible="1" />
+                    <field name="writable" invisible="1" />
                     <group>
-                        <field name="inbox_link" widget="url" />
+                        <field
+                            name="inbox_link"
+                            widget="url"
+                            invisible="not writable"
+                        />
                         <field name="name" />
                         <field name="accesses" />
                         <field name="expiration" />