do not try to show hidden bids from donation endpoints

[#188744956]

tests/apiv2/test_donations.py

@@ -6,6 +6,7 @@
 from django.contrib.auth.models import Permission, User
 from rest_framework.test import APIClient
 
+from tracker import models
 from tracker.api.serializers import DonationSerializer
 from tracker.api.views.donations import DONATION_CHANGE_LOG_MESSAGES
 from tracker.models import Event
@@ -23,6 +24,21 @@ def setUp(self):
         self.client = APIClient()
         self.client.force_authenticate(user=self.super_user)
         self.event = randgen.build_random_event(self.rand, num_runs=2, num_donors=2)
+        self.opened_parent_bid = randgen.generate_bid(
+            self.rand,
+            event=self.event,
+            allowuseroptions=True,
+            min_children=0,
+            max_children=0,
+        )[0]
+        self.opened_parent_bid.save()
+        self.pending_child = randgen.generate_bid(
+            self.rand,
+            parent=self.opened_parent_bid,
+            allowuseroptions=False,
+            state='PENDING',
+        )[0]
+        self.pending_child.save()
         self.event.use_one_step_screening = False
         self.event.save()
         self.other_event = randgen.build_random_event(
@@ -85,7 +101,11 @@ def test_unprocessed_returns_serialized_donations(self):
         self.generate_donations(self.other_event, count=1, state='pending')
 
         serialized = DonationSerializer(
-            donations, with_permissions=('tracker.change_donation',), many=True
+            models.Donation.objects.filter(
+                id__in=(d.id for d in donations)
+            ).prefetch_public_bids(),
+            with_permissions=('tracker.change_donation',),
+            many=True,
         )
 
         response = self.client.get(
@@ -162,7 +182,11 @@ def test_flagged_returns_serialized_donations(self):
         self.generate_donations(self.other_event, count=1, state='flagged')
 
         serialized = DonationSerializer(
-            donations, with_permissions=('tracker.change_donation',), many=True
+            models.Donation.objects.filter(
+                id__in=(d.id for d in donations)
+            ).prefetch_public_bids(),
+            with_permissions=('tracker.change_donation',),
+            many=True,
         )
 
         response = self.client.get(

tests/randgen.py

@@ -306,9 +306,12 @@ def generate_bid(
     else:
         bid.event = event
     children = []
-    if max_depth > 0 and true_false_or_random(rand, allow_children):
-        if state in ['PENDING', 'DENIED']:
-            bid.allowuseroptions = True
+    assert 0 <= min_children <= max_children
+    if (
+        max_depth > 0
+        and true_false_or_random(rand, allow_children or allowuseroptions)
+        and state not in ['PENDING', 'DENIED']
+    ):
         num_children = rand.randint(min_children, max_children)
         for c in range(0, num_children):
             children.append(
@@ -322,7 +325,11 @@ def generate_bid(
                     run=run,
                     event=event,
                     parent=bid,
-                    state=state,
+                    state=(
+                        state
+                        if allowuseroptions is not True
+                        else rand.choice([state, 'DENIED', 'PENDING'])
+                    ),
                 )
             )
         bid.istarget = False

tracker/api/views/donations.py

@@ -120,7 +120,7 @@ def get_queryset(self):
         Processing only occurs on Donations that have settled their transaction
         and were not tests.
         """
-        queryset = super().get_queryset().completed()
+        queryset = super().get_queryset().completed().prefetch_public_bids()
 
         event_id = self.request.query_params.get('event_id')
         if event_id is not None:
@@ -166,9 +166,7 @@ def unprocessed(self, request, *args, **kwargs):
         moderation), up to a maximum of TRACKER_PAGINATION_LIMIT donations.
         """
         limit = settings.TRACKER_PAGINATION_LIMIT
-        donations = (
-            self.get_queryset().to_process().prefetch_related('bids', 'bids__bid')
-        )[0:limit]
+        donations = (self.get_queryset().to_process())[0:limit]
         serializer = self.get_serializer(donations, many=True)
         return Response(serializer.data)
 
@@ -180,9 +178,7 @@ def flagged(self, request, *args, **kwargs):
         up to a maximum of TRACKER_PAGINATION_LIMIT donations.
         """
         limit = settings.TRACKER_PAGINATION_LIMIT
-        donations = (
-            self.get_queryset().to_approve().prefetch_related('bids', 'bids__bid')
-        )[0:limit]
+        donations = (self.get_queryset().to_approve())[0:limit]
         serializer = self.get_serializer(donations, many=True)
         return Response(serializer.data)
 
@@ -195,7 +191,7 @@ def unread(self, request, *args, **kwargs):
         TRACKER_PAGINATION_LIMIT donations.
         """
         limit = settings.TRACKER_PAGINATION_LIMIT
-        donations = (self.get_queryset().to_read().prefetch_related('bids'))[0:limit]
+        donations = (self.get_queryset().to_read())[0:limit]
         serializer = self.get_serializer(donations, many=True)
         return Response(serializer.data)
 

tracker/models/bid.py

@@ -619,6 +619,9 @@ class DonationBidQuerySet(models.QuerySet):
     def completed(self):
         return self.filter(donation__transactionstate='COMPLETED')
 
+    def public(self):
+        return self.completed().filter(bid__state__in=Bid.PUBLIC_STATES)
+
 
 class DonationBid(models.Model):
     objects = models.Manager.from_queryset(DonationBidQuerySet)()

tracker/models/donation.py

@@ -8,7 +8,7 @@
 from django.contrib.auth.models import User
 from django.core.exceptions import ValidationError
 from django.db import models
-from django.db.models import Avg, Count, FloatField, Max, Q, Sum, signals
+from django.db.models import Avg, Count, FloatField, Max, Prefetch, Q, Sum, signals
 from django.db.models.functions import Cast, Coalesce
 from django.dispatch import receiver
 from django.urls import reverse
@@ -81,6 +81,14 @@ def to_approve(self):
     def to_read(self):
         return self.completed().filter(readstate='READY')
 
+    def prefetch_public_bids(self):
+        from tracker.models import Bid, DonationBid
+
+        return self.prefetch_related(
+            Prefetch('bids', queryset=DonationBid.objects.public()),
+            Prefetch('bids__bid', queryset=Bid.objects.public()),
+        )
+
 
 class DonationManager(models.Manager):
     def get_by_natural_key(self, domainId):