SUBMIT-756 Invitation creation refactoring - avoid account project creation upfront (#778)

Author: dinesh-aot

submit-api/migrations/versions/2656a9b67883_unique_constraint_account_project.py

@@ -0,0 +1,64 @@
+"""unique constraint account project
+
+Revision ID: 2656a9b67883
+Revises: e9ede8ab9185
+Create Date: 2026-02-02 09:38:20.712941
+
+"""
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy.dialects import postgresql
+
+# revision identifiers, used by Alembic.
+revision = '2656a9b67883'
+down_revision = 'e9ede8ab9185'
+branch_labels = None
+depends_on = None
+
+
+def upgrade():
+    # ### commands auto generated by Alembic - please adjust! ###
+    # Rename existing submissiontypestatus to submissiontype (used by type column)
+    op.execute("ALTER TYPE submissiontypestatus RENAME TO submissiontype")
+    
+    # Create new submissiontypestatus enum for status column
+    op.execute("CREATE TYPE submissiontypestatus AS ENUM ('SUBMITTED', 'REJECTED', 'APPROVED', 'PENDING', 'PENDING_REPLACEMENT')")
+    
+    with op.batch_alter_table('submissions', schema=None) as batch_op:
+        # Change status column from submissionstatus to submissiontypestatus
+        batch_op.alter_column('status',
+               existing_type=postgresql.ENUM('SUBMITTED', 'REJECTED', 'APPROVED', 'PENDING', 'PENDING_REPLACEMENT', name='submissionstatus'),
+               type_=sa.Enum('SUBMITTED', 'REJECTED', 'APPROVED', 'PENDING', 'PENDING_REPLACEMENT', name='submissiontypestatus'),
+               existing_nullable=True,
+               postgresql_using='status::text::submissiontypestatus')
+    
+    with op.batch_alter_table('account_projects', schema=None) as batch_op:
+        batch_op.create_unique_constraint('uq_account_project', ['account_id', 'project_id'])
+    
+    # Drop old unused enum type
+    op.execute("DROP TYPE IF EXISTS submissionstatus")
+
+    # ### end Alembic commands ###
+
+
+def downgrade():
+    # ### commands auto generated by Alembic - please adjust! ###
+    # Recreate the old enum type
+    op.execute("CREATE TYPE submissionstatus AS ENUM ('SUBMITTED', 'REJECTED', 'APPROVED', 'PENDING', 'PENDING_REPLACEMENT')")
+    
+    with op.batch_alter_table('submissions', schema=None) as batch_op:
+        # Revert status column from submissiontypestatus back to submissionstatus
+        batch_op.alter_column('status',
+               existing_type=sa.Enum('SUBMITTED', 'REJECTED', 'APPROVED', 'PENDING', name='submissiontypestatus'),
+               type_=postgresql.ENUM('SUBMITTED', 'REJECTED', 'APPROVED', 'PENDING', 'PENDING_REPLACEMENT', name='submissionstatus'),
+               existing_nullable=True,
+               postgresql_using='status::text::submissionstatus')
+    
+    with op.batch_alter_table('account_projects', schema=None) as batch_op:
+        batch_op.drop_constraint('uq_account_project', type_='unique')
+    
+    # Drop the enum type created in upgrade and rename submissiontype back
+    op.execute("DROP TYPE IF EXISTS submissiontypestatus")
+    op.execute("ALTER TYPE submissiontype RENAME TO submissiontypestatus")
+
+    # ### end Alembic commands ###

submit-api/src/submit_api/models/account_project.py

@@ -4,7 +4,7 @@
 """
 from __future__ import annotations
 
-from sqlalchemy import Column, ForeignKey
+from sqlalchemy import Column, ForeignKey, UniqueConstraint
 
 from .base_model import BaseModel
 from .db import db
@@ -14,6 +14,9 @@ class AccountProject(BaseModel):
     """Definition of the Account Project entity."""
 
     __tablename__ = 'account_projects'
+    __table_args__ = (
+        UniqueConstraint('account_id', 'project_id', name='uq_account_project'),
+    )
 
     id = Column(db.Integer, primary_key=True, autoincrement=True)
     account_id = Column(db.Integer, ForeignKey('accounts.id', ondelete='CASCADE'), nullable=False)

submit-api/src/submit_api/models/submission.py

@@ -37,7 +37,7 @@ class Submission(BaseModel):
     id = Column(db.Integer, primary_key=True, autoincrement=True)
     submitted_form_id = Column(db.Integer, ForeignKey('submitted_forms.id'), nullable=True)
     item_id = Column(db.Integer, ForeignKey('items.id', ondelete='CASCADE'), nullable=False)
-    type = Column(Enum(SubmissionType), nullable=False)
+    type = Column(Enum(SubmissionType, name='submissiontype'), nullable=False)
     submitted_document_id = Column(db.Integer, ForeignKey('submitted_documents.id'), nullable=True)
     submitted_form = db.relationship('SubmittedForm', foreign_keys=[submitted_form_id], lazy='joined')
     submitted_document = db.relationship('SubmittedDocument', foreign_keys=[submitted_document_id], lazy='joined')

submit-api/src/submit_api/resources/migration_ops.py

@@ -65,8 +65,8 @@ def post():  # pylint: disable=too-many-locals,too-many-statements
             # Query all foreign key constraints that reference users.auth_guid
             current_app.logger.info("Querying foreign key constraints on users.auth_guid...")
             fk_query = text("""
-                SELECT 
-                    tc.table_name, 
+                SELECT
+                    tc.table_name,
                     tc.constraint_name,
                     kcu.column_name
                 FROM information_schema.table_constraints AS tc

submit-api/src/submit_api/services/invitation_service.py

@@ -139,13 +139,12 @@ def create_invitation(invite_data):
         account_id = invite_data.get('account_id')
         role_name = invite_data.get('role_name')
         proponent_id = invite_data.get('proponent_id')
-        project_ids = invite_data.get('project_ids')
 
         role = InvitationService._validate_fetch_role(role_name)
 
         with session_scope() as session:
             account = InvitationService._get_or_create_account(
-                account_id, proponent_id, project_ids, session)
+                account_id, proponent_id, session)
             session.flush()
 
             token = InvitationService.generate_uuid_token()
@@ -200,6 +199,10 @@ def accept_invitation(token, payload):
             account_user = InvitationService._create_account_user(
                 user.id, invitation.account_id, payload, session)
 
+            # Create account projects if they don't exist (handles concurrent invitations gracefully)
+            InvitationService._create_account_projects(
+                invitation.account_id, invitation.project_ids, session)
+
             account_projects = AccountProjectModel.get_all_in_project_ids(invitation.project_ids)
             roles = []
             for account_project in account_projects:
@@ -260,13 +263,13 @@ def _validate_invitation_access(invitation):
         return True
 
     @staticmethod
-    def _get_or_create_account(account_id, proponent_id, project_ids, session):
+    def _get_or_create_account(account_id, proponent_id, session):
         """Retrieve or create an account based on proponent_id or account_id."""
         if account_id:
             return InvitationService._get_account_by_id(account_id)
 
         if proponent_id:
-            return InvitationService._get_or_create_account_by_proponent(proponent_id, project_ids, session)
+            return InvitationService._get_or_create_account_by_proponent(proponent_id, session)
 
         raise ResourceNotFoundError("No valid account found for the provided data.")
 
@@ -281,14 +284,12 @@ def _get_proponent_by_id(proponent_id):
         return ProponentModel.find_by_id(proponent_id)
 
     @staticmethod
-    def _get_or_create_account_by_proponent(proponent_id, project_ids, session):
+    def _get_or_create_account_by_proponent(proponent_id, session):
         """Retrieve or create an account by proponent_id."""
         account = AccountModel.get_by_proponent_id(proponent_id)
         if not account:
             account_data = {'proponent_id': proponent_id}
             account = AccountModel.create_account(account_data, session)
-        InvitationService._create_account_projects(
-            account.id, project_ids, session)
         return account
 
     @staticmethod
@@ -313,7 +314,7 @@ def _create_invitation_record(invite_data, role, account, token, session):
             role_id=role.id,
             package_ids=invite_data.get('package_ids'),
             original_package_ids=invite_data.get('original_package_ids'),
-            expiry_date=datetime.datetime.utcnow() + datetime.timedelta(days=expiry_days),
+            expiry_date=datetime.datetime.now(datetime.timezone.utc) + datetime.timedelta(days=expiry_days),
             is_first_time=is_first_time
         )
         session.add(invitation)
@@ -396,7 +397,12 @@ def get_valid_invitation(token):
         if invitation.status != InvitationStatus.PENDING.value:
             return {"error": "Invitation is not valid"}, False
 
-        if invitation.expiry_date < datetime.datetime.utcnow():
+        # Ensure expiry_date is timezone-aware for comparison
+        expiry_date = invitation.expiry_date
+        if expiry_date.tzinfo is None:
+            expiry_date = expiry_date.replace(tzinfo=datetime.timezone.utc)
+
+        if expiry_date < datetime.datetime.now(datetime.timezone.utc):
             return {"error": "Invitation has expired"}, False
 
         # Update proponent status
@@ -428,7 +434,7 @@ def resend_invitation(token):
             InvitationService._check_action_authorized(invitation.project_ids)
 
             # Extend expiry date by 1 week from current date
-            invitation.expiry_date = datetime.datetime.utcnow() + datetime.timedelta(weeks=1)
+            invitation.expiry_date = datetime.datetime.now(datetime.timezone.utc) + datetime.timedelta(weeks=1)
 
             InvitationService._create_email_queue_record(
                 invitation.id, session)

submit-api/tests/unit/resources/test_invitation.py

@@ -3,7 +3,7 @@
 Tests for invitation resource endpoints.
 """
 
-from datetime import datetime, timedelta, UTC
+from datetime import datetime, timedelta, timezone
 from http import HTTPStatus
 from unittest.mock import patch
 
@@ -124,7 +124,7 @@ def test_get_invitation_expired(client, session, jwt):
     _, account_project = setup_authenticated_proponent(session, jwt)
     invitation = factory_invitation_model(
         account_id=account_project.account_id,
-        expiry_date=datetime.now(UTC) - timedelta(days=1),  # Expired
+        expiry_date=datetime.now(timezone.utc) - timedelta(days=1),  # Expired
     )
 
     response = client.get(f"/api/invitations/{invitation.token}")
@@ -161,6 +161,7 @@ def test_accept_invitation(client, session, jwt):
     _, account_project = setup_authenticated_proponent(session, jwt)
     invitation = factory_invitation_model(
         account_id=account_project.account_id,
+        project_ids=[account_project.project_id]
     )
 
     payload = {
@@ -182,6 +183,12 @@ def test_accept_invitation(client, session, jwt):
     print(data)
     assert "user_id" in data
 
+    # Verify that account_projects were created during acceptance
+    from submit_api.models import AccountProject as AccountProjectModel
+    account_projects = AccountProjectModel.get_all_in_project_ids(invitation.project_ids)
+    assert len(account_projects) > 0
+    assert any(ap.account_id == invitation.account_id for ap in account_projects)
+
 
 def test_accept_invitation_invalid_token(client, session):
     """Test accepting invitation with invalid token."""

submit-api/tests/utilities/factory_utils.py

@@ -16,7 +16,7 @@
 
 Test Utility for creating model factory.
 """
-from datetime import datetime, timedelta, UTC
+from datetime import datetime, timedelta, timezone
 import random
 import string
 
@@ -190,11 +190,15 @@ def factory_invitation_model(
     token=fake.uuid4(),
     email=fake.email(),
     status=InvitationStatus.PENDING.value,
-    expiry_date=datetime.now(UTC) + timedelta(days=7),
+    expiry_date=datetime.now(timezone.utc) + timedelta(days=7),
     role_id=None,
     is_first_time=False
 ):
     """Create and return a mock invitation entry."""
+    if role_id is None:
+        role = Role.get_by_name(RoleEnum.PROJECT_ADMIN.value)
+        role_id = role.id if role else None
+
     invitation = Invitations(
         account_id=account_id,
         project_ids=project_ids,