Merge branch 'master' into TP2000-1680-no-comm-code-workbaskets

.gitignore

@@ -113,6 +113,7 @@ ENV/
 env.bak/
 docker-compose.override.yml
 settings/envs/docker.override.env
+.envrc
 
 # Spyder project settings
 .spyderproject

commodities/models/dc.py

@@ -1600,8 +1600,7 @@ def _apply_filters(qs: TrackedModelQuerySet):
         goods_sids = Subquery(goods_query.values("sid"))
 
         indents_query = (
-            _apply_filters(GoodsNomenclatureIndent.objects)
-            .with_end_date()
+            _apply_filters(GoodsNomenclatureIndent.objects.with_end_date())
             .filter(indented_goods_nomenclature__sid__in=goods_sids)
             .annotate(goods_sid=F("indented_goods_nomenclature__sid"))
             .order_by("transaction", "validity_start")

commodities/tests/test_commodity_tree_snapshot.py

@@ -92,3 +92,11 @@ def test_get_dependent_measures_works_with_wonky_archived_measure(
     assert wonky_archived_measure.generating_regulation == old_regulation
     assert target_commodity in commodities_collection.commodities
     assert target_commodity in target.commodities
+
+
+def test_commodity_collection_loader(seed_database_with_indented_goods):
+    # Test that 'effective_only' does not crash the code
+    commodities_collection = CommodityCollectionLoader(prefix="2903").load(
+        effective_only=True,
+    )
+    assert len(commodities_collection.commodities) == 6

common/static/common/js/application.js

@@ -9,6 +9,7 @@ const imagePath = (name) => images(name, true);
 
 require.context("govuk-frontend/govuk/assets");
 
+import "./trustedTypes";
 import { initAll } from "govuk-frontend";
 
 import showHideCheckboxes from "./showHideCheckboxes";

common/static/common/js/trustedTypes.js

@@ -0,0 +1,12 @@
+import DOMPurify from "dompurify";
+
+/**
+ * Creates a default Trusted Types policy that serves as a fallback policy
+ * to sanitise direct sink usage in third-party dependencies.
+ */
+if (typeof window.trustedTypes !== "undefined") {
+  window.trustedTypes.createPolicy("default", {
+    createHTML: (to_escape) =>
+      DOMPurify.sanitize(to_escape, { RETURN_TRUSTED_TYPE: true }),
+  });
+}

measures/duty_sentence_parser.py

@@ -379,6 +379,12 @@ def validate_measurement(self, unit, qualifier):
                 f"Measurement unit qualifier {qualifier.abbreviation} cannot be used with measurement unit {unit.abbreviation}.",
             )
 
+    def validate_duty_amount(self, duty_amount):
+        if duty_amount.as_tuple().exponent < -3:
+            raise ValidationError(
+                f"The reference price cannot have more than 3 decimal places.",
+            )
+
     def validate_phrase(self, phrase):
         # Each measure component can have an amount, monetary unit and measurement.
         # Which expression elements are allowed in a component is controlled by
@@ -393,6 +399,9 @@ def validate_phrase(self, phrase):
         measurement_unit = phrase.get("measurement_unit", None)
         measurement_unit_qualifier = phrase.get("measurement_unit_qualifier", None)
 
+        if duty_amount:
+            self.validate_duty_amount(duty_amount)
+
         self.validate_according_to_applicability_code(
             amount_code,
             duty_expression,

measures/forms/mixins.py

@@ -252,13 +252,6 @@ def conditions_clean(
             try:
                 components = parser.transform(price)
                 cleaned_data["duty_amount"] = components[0].get("duty_amount")
-                if (
-                    cleaned_data["duty_amount"]
-                    and len(str(cleaned_data["duty_amount"]).split(".")[-1]) > 3
-                ):
-                    raise ValidationError(
-                        f"The reference price cannot have more than 3 decimal places.",
-                    )
                 cleaned_data["monetary_unit"] = components[0].get("monetary_unit")
                 cleaned_data["condition_measurement"] = (
                     models.Measurement.objects.as_at(date)

measures/tests/test_forms.py

@@ -1025,6 +1025,10 @@ def test_measure_forms_conditions_invalid_duty(
             "3.5 % + 11 GBP / 100 kg",
             "A compound duty expression was found at character 7. \n\nCheck that you are entering a single duty amount or a duty amount together with a measurement unit (and measurement unit qualifier if required). ",
         ),
+        (
+            "1.2345 GBP / kg",
+            "The reference price cannot have more than 3 decimal places.",
+        ),
     ],
 )
 def test_measure_forms_conditions_wizard_invalid_duty(
@@ -1220,37 +1224,6 @@ def test_measure_forms_conditions_wizard_clears_unneeded_certificate(date_ranges
         assert form_expects_no_certificate.cleaned_data["required_certificate"] is None
 
 
-def test_measure_forms_conditions_wizard_form_invalid_duty(date_ranges):
-    """Tests that MeasureConditionsWizardStepForm is invalid when the duty has
-    more than 3 decimal places."""
-    condition_code = factories.MeasureConditionCodeFactory.create()
-    monetary_unit = factories.MonetaryUnitFactory.create()
-    factories.MeasurementUnitFactory.create()
-    factories.MeasurementUnitQualifierFactory.create()
-    factories.MeasureConditionComponentFactory.create()
-    factories.DutyExpressionFactory.create(sid=99)
-    action = factories.MeasureActionFactory.create()
-
-    data = {
-        "reference_price": f"1.2345 {monetary_unit.code}",
-        "action": action.pk,
-        "condition_code": condition_code.pk,
-    }
-    # MeasureConditionsForm.__init__ expects prefix kwarg for instantiating crispy forms `Layout` object
-    form = forms.MeasureConditionsWizardStepForm(
-        data,
-        prefix="",
-        measure_start_date=date_ranges.normal,
-    )
-
-    with override_current_transaction(action.transaction):
-        assert not form.is_valid()
-        assert (
-            "The reference price cannot have more than 3 decimal places."
-            in form.errors["reference_price"]
-        )
-
-
 def test_measure_form_valid_data(erga_omnes, session_request_with_workbasket):
     """Test that MeasureForm.is_valid returns True when passed required fields
     and geographical_area and sid fields in cleaned data."""
@@ -2003,6 +1976,8 @@ def test_simple_measure_edit_forms_serialize_deserialize(
 ):
     """Test that the EditMeasure simple forms that use the SerializableFormMixin
     behave correctly and as expected."""
+    """Test that the EditMeasure simple forms that use the SerializableFormMixin
+    behave correctly and as expected."""
 
     # Create some measures to apply this data to, for the kwargs
     quota_order_number = factories.QuotaOrderNumberFactory()

package.json

@@ -21,6 +21,7 @@
     "chart.js": "^3.9.1",
     "chartjs-adapter-moment": "^1.0.0",
     "css-loader": "^5.2.6",
+    "dompurify": "^3.2.3",
     "file-loader": "^6.2.0",
     "govuk-frontend": "^3.15.0",
     "govuk-react": "^0.10.6",
@@ -78,4 +79,4 @@
     "pre-commit": "^1.2.2",
     "react-test-renderer": "^18.2.0"
   }
-}
+}