forbid expansion deletion

antarest/study/service.py

@@ -2644,14 +2644,16 @@ def asserts_no_thermal_in_binding_constraints(
     def delete_file_or_folder(self, study_id: str, path: str, current_user: JWTUser) -> None:
         study = self.get_study(study_id)
         assert_permission(current_user, study, StudyPermissionType.WRITE)
-        study_tree = self.storage_service.raw_study_service.get_raw(study, True).tree
-        whole_study_built = study_tree.build()
         url = [item for item in path.split("/") if item]
-        if len(url) == 0:
-            raise FileOrFolderDeletionFailed(f"the path is invalid: {path}")
+        if len(url) < 2:
+            raise FileOrFolderDeletionFailed(f"the given path cannot be treated: {path}")
+        if url[0] == "user" and url[1] == "expansion":
+            raise FileOrFolderDeletionFailed("you cannot delete a file/folder inside expansion folder")
+        study_tree = self.storage_service.raw_study_service.get_raw(study, True).tree.build()
         try:
-            whole_study_built["user"].delete(url[1:])
+            study_tree["user"].delete(url[1:])
         except ChildNotFoundError as e:
             raise FileOrFolderDeletionFailed(
                 f"the file doesn't exist or you're not inside the 'User' folder: {e.detail}"
             )
+        # todo: I don't really like the way exception are handled. I would prefer having a FORBIDDEN if so and an 404 otherwise.

tests/integration/test_integration.py

@@ -1930,16 +1930,21 @@ def test_delete_raw(client: TestClient, user_access_token: str, internal_study_i
     #  ERRORS
     # =============================
 
+    # try to delete expansion folder
+    res = client.delete(f"/v1/studies/{internal_study_id}/raw?path=/user/expansion")
+    assert res.status_code == 417
+    assert res.json()["exception"] == "FileOrFolderDeletionFailed"
+    assert "you cannot delete a file/folder inside expansion folder" in res.json()["description"]
     # try to delete a file which isn't inside the 'User' folder
     res = client.delete(f"/v1/studies/{internal_study_id}/raw?path=/input/thermal")
     assert res.status_code == 417
     assert res.json()["exception"] == "FileOrFolderDeletionFailed"
     assert "the file doesn't exist or you're not inside the 'User' folder" in res.json()["description"]
-    # With an empty path.
-    res = client.delete(f"/v1/studies/{internal_study_id}/raw?path=")
+    # With an empty path
+    res = client.delete(f"/v1/studies/{internal_study_id}/raw?path=fake_path")
     assert res.status_code == 417
     assert res.json()["exception"] == "FileOrFolderDeletionFailed"
-    assert "the path is invalid" in res.json()["description"]
+    assert "the given path cannot be treated" in res.json()["description"]
     # With a path that doesn't exist
     res = client.delete(f"/v1/studies/{internal_study_id}/raw?path=fake_folder/fake_file")
     assert res.status_code == 417