adapted /measurements

api/measurement.yaml

@@ -4,7 +4,7 @@
   get:
     summary: measurement values by id
     description: 'Auth: all, levels: read, write, maintain, dev, admin'
-    x-doc: status handling (accessible (only for maintain/admin))?  # TODO after decision
+    x-doc: deleted samples are available only for maintain/admin
     tags:
       - /measurement
     responses:
@@ -25,7 +25,7 @@
   put:
     summary: change measurement
     description: 'Auth: basic, levels: write, maintain, dev, admin'
-    x-doc: status is reset to 0 on any changes
+    x-doc: status is reset to 0 on any changes, deleted measurements cannot be edited
     tags:
       - /measurement
     security:

src/routes/measurement.spec.ts

@@ -255,6 +255,15 @@ describe('/measurement', () => {
         httpStatus: 404
       });
     });
+    it('rejects editing a deleted measurement', done => {
+      TestHelper.request(server, done, {
+        method: 'put',
+        url: '/measurement/800000000000000000000004',
+        auth: {basic: 'admin'},
+        httpStatus: 403,
+        req: {}
+      });
+    });
     it('rejects an API key', done => {
       TestHelper.request(server, done, {
         method: 'put',

src/routes/measurement.ts

@@ -38,6 +38,9 @@ router.put('/measurement/' + IdValidate.parameter(), async (req, res, next) => {
   if (!data) {
     return res.status(404).json({status: 'Not found'});
   }
+  if (data.status === globals.status.deleted) {
+    return res.status(403).json({status: 'Forbidden'});
+  }
 
   // add properties needed for sampleIdCheck
   measurement.measurement_template = data.measurement_template;