fix: soft-deleted된 event 설정 가능 문제 수정 및 is_document_valid 미충족 issuable 발급 시도 방어

Author: MU-Software

app/admin_api/serializers/shop/products.py

@@ -11,6 +11,7 @@
 )
 from core.util.timespan import TimeSpan
 from document.models import IssuedDocument
+from event.models import Event
 from file.models import PublicFile
 from rest_framework import serializers
 from shop.order.models import OrderProductRelation
@@ -20,6 +21,9 @@
 class CategoryGroupAdminSerializer(BaseAbstractSerializer, JsonSchemaSerializer, NestedFieldModelSerializer):
     class CategoryAdminSerializer(BaseAbstractSerializer, JsonSchemaSerializer, NestedModelSerializer):
         id = serializers.UUIDField(required=False, help_text="기존 Category 수정 시 PK 전달, 새로 추가 시 생략")
+        event = serializers.PrimaryKeyRelatedField(
+            queryset=Event.objects.filter_active(), allow_null=True, required=False
+        )
 
         class Meta:
             model = Category

app/admin_api/test/shop/ticket_info_admin_test.py

@@ -1,5 +1,6 @@
 import pytest
 from admin_api.test.helpers import CategoryGroupsAdminApi, OrdersAdminApi
+from model_bakery import baker
 from rest_framework.status import HTTP_200_OK, HTTP_400_BAD_REQUEST
 from shop.conftest import VALID_TICKET_INFO
 from shop.order.models import TicketInfo
@@ -70,3 +71,29 @@ def test_admin_order_exposes_ticket_info(api_client, ticket_opr):
     assert response.status_code == HTTP_200_OK
     product_dto = next(p for p in response.json()["products"] if p["id"] == str(ticket_opr.id))
     assert product_dto["ticket_info"] == {**VALID_TICKET_INFO, "contribution_message": "응원"}
+
+
+# ==================== category.event — soft-deleted Event 연결 거부 ====================
+
+
+@pytest.mark.django_db
+def test_admin_category_rejects_soft_deleted_event(api_client, ticket_product):
+    deleted_event = baker.make("event.Event", name="삭제된 행사")
+    deleted_event.delete()  # soft-delete → filter_active() 에서 제외되어야 함.
+    category = ticket_product.category
+    response = CategoryGroupsAdminApi(http_client=api_client).update(
+        category.group_id,
+        {
+            "categories": [
+                {
+                    "id": str(category.id),
+                    "name": category.name,
+                    "priority": category.priority,
+                    "event": str(deleted_event.id),
+                }
+            ]
+        },
+    )
+    assert response.status_code == HTTP_400_BAD_REQUEST
+    category.refresh_from_db()
+    assert category.event_id is None

app/document/issuable.py

@@ -12,6 +12,9 @@
 class IssuableMixin:
     ISSUED_DOCUMENT_TYPE: ClassVar[str]
 
+    class NotIssuableError(Exception):
+        """is_document_valid() 조건을 충족하지 않는 issuable 에 대한 발급 시도 — 도메인 경계 가드."""
+
     class DocumentStatus(models.TextChoices):
         not_issuable = "not_issuable", "발급 불가"  # is_document_valid 조건 미충족
         issuable = "issuable", "발급 가능"  # 조건 충족, 아직 미발급
@@ -38,6 +41,8 @@ def get_issued_document(self) -> IssuedDocument | None:
     def issue_document(self) -> IssuedDocument:
         from document.models import DocumentTemplate, IssuedDocument
 
+        if not self.is_document_valid():
+            raise self.NotIssuableError(f"{type(self).__name__} 은 현재 발급 가능 상태가 아닙니다.")
         return IssuedDocument.objects.create(
             issuable=self,
             template=DocumentTemplate.objects.get_active(self.ISSUED_DOCUMENT_TYPE),

app/shop/order/test/opr_model_test.py

@@ -82,3 +82,13 @@ def test_build_verify_display_maps_frozen_context():
 def test_is_document_downloadable_by_only_order_owner(used_ticket_opr, other_user):
     assert used_ticket_opr.is_document_downloadable_by(used_ticket_opr.order.user) is True
     assert used_ticket_opr.is_document_downloadable_by(other_user) is False
+
+
+@pytest.mark.django_db
+def test_issue_document_rejected_for_invalid_opr(used_ticket_opr):
+    # event 연결을 끊으면 is_document_valid=False → 모델 경계 가드가 직접 발급(view 우회)을 막는다.
+    category = used_ticket_opr.product.category
+    category.event = None
+    category.save(update_fields=["event"])
+    with pytest.raises(OrderProductRelation.NotIssuableError):
+        used_ticket_opr.get_or_issue_document()