add_assertion: don't assume a random user if not given

Fixes: #68

Signed-off-by: Aurélien Bompard <[email protected]>

tahrir_api/dbapi.py

@@ -648,10 +648,9 @@ def add_invitation(self, badge_id, created_on=None, expires_on=None, created_by_
 
         created_on = created_on or datetime.now(timezone.utc)
         expires_on = expires_on or (created_on + timedelta(hours=1))
-        if self.person_exists(email=created_by_email):
-            created_by = self.get_person(created_by_email).id
-        else:
-            created_by = self.session.query(Person).first().id
+        if not created_by_email or not self.person_exists(email=created_by_email):
+            raise ValueError(f"No user with email {created_by_email!r}. Ask them to login first.")
+        created_by = self.get_person(created_by_email).id
 
         invitation = Invitation(
             created_on=created_on,

tests/test_dbapi.py

@@ -1,3 +1,6 @@
+import pytest
+
+
 def test_add_badges(api):
     issuer_id = api.add_issuer("TestOrigin", "TestName", "TestOrg", "TestContact")
     api.add_badge(
@@ -76,9 +79,25 @@ def test_add_invitation(api):
         "TestCriteria",
         issuer_id,
     )
-    _id = api.add_invitation(badge_id)
+    _id = api.add_invitation(badge_id, created_by_email="[email protected]")
 
     assert api.invitation_exists(_id)
+    invitation = api.get_invitation(_id)
+    assert api.get_person(id=invitation.created_by).email == "[email protected]"
+
+
+def test_add_invitation_no_created_by(api):
+    issuer_id = api.add_issuer("TestOrigin", "TestName", "TestOrg", "TestContact")
+    api.add_person("[email protected]")
+    badge_id = api.add_badge(
+        "TestBadge",
+        "TestImage",
+        "A test badge for doing unit tests",
+        "TestCriteria",
+        issuer_id,
+    )
+    with pytest.raises(ValueError):
+        api.add_invitation(badge_id)
 
 
 def test_last_login(api, callback_calls):