Fix data source configuration resource

obj_get raised tastypie's NotFound, which get_detail does not catch, so a
GET for an unknown id returned a 500 rather than a 404.

The obj_update change is a refactor with no behavior change: put_detail
already answered 404 once it stopped echoing the exception message. It
replaces the duplicated Http404 conversion with the couch mixin helper.

Author: gherceg

corehq/apps/api/resources/__init__.py

@@ -359,7 +359,14 @@ def detail_uri_kwargs(self, bundle_or_obj):
 
     def get_document_for_update(self, doc_id, domain):
         """
-        Converts ``ObjectDoesNotExist`` into ``tastypie.NotFound``
+        Converts ``ObjectDoesNotExist`` into ``tastypie.NotFound``.
+
+        Converting only here makes ``NotFound`` mean exactly "the object
+        addressed by this URL does not exist", which is what
+        ``HqBaseResource.put_detail`` turns into a 404. Tastypie's own
+        ``ModelResource.obj_update`` does the same conversion in the same
+        place; couch resources need this because they are not
+        ``ModelResource`` subclasses.
         """
         try:
             return get_object_or_not_exist(self._meta.object_class, doc_id, domain)

corehq/apps/api/resources/v0_5.py

@@ -67,6 +67,7 @@
 from corehq.apps.api.util import (
     django_date_filter,
     get_obj,
+    get_object_or_not_exist,
     make_date_filter,
     parse_str_to_date,
     cursor_based_query_for_datasource
@@ -1022,13 +1023,7 @@ def _ensure_toggle_enabled(self, request):
 
     def obj_get(self, bundle, **kwargs):
         self._ensure_toggle_enabled(bundle.request)
-        domain = kwargs['domain']
-        pk = kwargs['pk']
-        try:
-            data_source = get_document_or_404(DataSourceConfiguration, domain, pk)
-        except Http404 as e:
-            raise NotFound(str(e))
-        return data_source
+        return get_object_or_not_exist(DataSourceConfiguration, kwargs['pk'], kwargs['domain'])
 
     def obj_get_list(self, bundle, **kwargs):
         self._ensure_toggle_enabled(bundle.request)
@@ -1037,12 +1032,7 @@ def obj_get_list(self, bundle, **kwargs):
 
     def obj_update(self, bundle, **kwargs):
         self._ensure_toggle_enabled(bundle.request)
-        domain = kwargs['domain']
-        pk = kwargs['pk']
-        try:
-            data_source = get_document_or_404(DataSourceConfiguration, domain, pk)
-        except Http404 as e:
-            raise NotFound(str(e))
+        data_source = self.get_document_for_update(kwargs['pk'], kwargs['domain'])
         allowed_update_fields = [
             'display_name',
             'configured_filter',
@@ -1075,6 +1065,7 @@ def detail_uri_kwargs(self, bundle_or_obj):
 
     class Meta(CustomResourceMeta):
         resource_name = 'ucr_data_source'
+        object_class = DataSourceConfiguration
         list_allowed_methods = ['get']
         detail_allowed_methods = ['get', 'put']
         always_return_data = True

corehq/apps/api/tests/test_ucr_resources.py

@@ -167,6 +167,12 @@ class TestDataSourceConfigurationResource(APIResourceTest):
     resource = v0_5.DataSourceConfigurationResource
     api_name = "v0.5"
 
+    @flag_enabled('USER_CONFIGURABLE_REPORTS')
+    def test_cant_get_missing_data_source(self):
+        response = self._assert_auth_get_resource(self.single_endpoint(uuid.uuid4().hex))
+
+        assert response.status_code == 404, response.content
+
     @flag_enabled('USER_CONFIGURABLE_REPORTS')
     def test_cant_update_missing_data_source(self):
         response = self._assert_auth_post_resource(
@@ -180,6 +186,26 @@ def test_cant_update_missing_data_source(self):
         # detail, and get_document_or_404 even embeds a traceback
         assert response.content == b""
 
+    @flag_enabled('USER_CONFIGURABLE_REPORTS')
+    def test_cant_update_data_source_in_another_domain(self):
+        not_my_data_source = DataSourceConfiguration(
+            domain='not-my-project',
+            referenced_doc_type="XFormInstance",
+            table_id=uuid.uuid4().hex,
+            display_name="theirs",
+        )
+        not_my_data_source.save()
+        self.addCleanup(not_my_data_source.delete)
+
+        response = self._assert_auth_post_resource(
+            self.single_endpoint(not_my_data_source._id),
+            json.dumps({"display_name": "mine now"}),
+            method="PUT",
+        )
+
+        assert response.status_code == 404, response.content
+        assert DataSourceConfiguration.get(not_my_data_source._id).display_name == "theirs"
+
 
 class TestConfigurableReportDataResource(APIResourceTest):
     resource = v0_5.ConfigurableReportDataResource