Add ability to add Request comment in REST API #345

Signed-off-by: tdruez <tdruez@nexb.com>

Author: tdruez

docs/integrations-rest-api.rst

@@ -204,3 +204,25 @@ Allows updating only specific fields. For example, to close a request::
     response = requests.patch(api_url, headers=headers, json=data)
     print(response.json())
 
+Add comment
+-----------
+
+``POST /api/v2/requests/{uuid}/add_comment/``
+
+This endpoint allows you to attach a new comment to an existing request.
+A successful call will store the comment and return a confirmation message.
+
+**Payload example**:
+
+.. code-block:: json
+
+    {
+        "text": "Comment content"
+    }
+
+**Notes**:
+ - The ``uuid`` in the URL must correspond to the target request.
+ - The ``text`` field is required and should contain the full comment content.
+ - Comments are attributed to the authenticated user making the request.
+ - A successful request returns HTTP 201 with a status message.
+ - Invalid or missing fields will return HTTP 400 along with error details.

workflow/api.py

@@ -14,6 +14,9 @@
 
 import django_filters
 from rest_framework import serializers
+from rest_framework import status
+from rest_framework.decorators import action
+from rest_framework.response import Response
 from rest_framework.viewsets import ReadOnlyModelViewSet
 
 from dje.api import CreateRetrieveUpdateListViewSet
@@ -407,3 +410,19 @@ def perform_update(self, serializer):
             event_type=RequestEvent.EDIT,
             dataspace=self.request.user.dataspace,
         )
+
+    @action(
+        detail=True,
+        methods=["post"],
+        serializer_class=RequestCommentSerializer,
+    )
+    def add_comment(self, request, *args, **kwargs):
+        """Add a comment to this request."""
+        request_instance = self.get_object()
+
+        serializer = RequestCommentSerializer(data=request.data)
+        if serializer.is_valid():
+            request_instance.add_comment(self.request.user, **serializer.validated_data)
+            return Response({"status": "Comment added."}, status=status.HTTP_201_CREATED)
+
+        return Response(serializer.errors, status=status.HTTP_400_BAD_REQUEST)

workflow/models.py

@@ -602,6 +602,14 @@ def serialize_hook(self, hook):
             "data": serializer.data,
         }
 
+    def add_comment(self, user, text):
+        """Create and return a RequestComment for this Request."""
+        return self.comments.create(
+            user=user,
+            text=text,
+            dataspace=self.dataspace,
+        )
+
     def close(self, user, reason):
         """
         Set the Request status to CLOSED.

workflow/tests/test_api.py

@@ -786,6 +786,24 @@ def test_api_request_endpoint_edit_serialized_data(self):
         expected = {"serialized_data": ['"Organization" is required.']}
         self.assertEqual(expected, response.data)
 
+    def test_api_request_endpoint_add_comment_action(self):
+        self.client.login(username="super_user", password="secret")
+        add_comment_url = reverse("api_v2:request-add-comment", args=[self.request1.uuid])
+
+        data = {}
+        response = self.client.post(add_comment_url, data=data)
+        self.assertEqual(status.HTTP_400_BAD_REQUEST, response.status_code)
+        expected = {
+            "text": ["This field is required."],
+        }
+        self.assertEqual(expected, response.json())
+
+        data = {"text": "Comment content."}
+        response = self.client.post(add_comment_url, data=data)
+        self.assertEqual(status.HTTP_201_CREATED, response.status_code)
+        expected = {"status": "Comment added."}
+        self.assertEqual(expected, response.data)
+
     def test_api_request_and_request_template_endpoints_tab_permission(self):
         self.assertEqual((TabPermission,), RequestViewSet.extra_permissions)
         self.assertEqual((TabPermission,), RequestTemplateViewSet.extra_permissions)