Merge pull request #481 from awf-dbca/wl-surrender-fix

WL surrender fix

mooringlicensing/components/approvals/api.py

@@ -698,7 +698,7 @@ def approval_reinstate(self, request, *args, **kwargs):
         else:
             raise serializers.ValidationError("User not authorised to reinstate approval")
 
-    @detail_route(methods=['POST',], detail=True, permission_classes=[InternalApprovalPermission])
+    @detail_route(methods=['POST',], detail=True)
     @basic_exception_handler
     def approval_surrender(self, request, *args, **kwargs):
         instance = self.get_object()

mooringlicensing/components/approvals/models.py

@@ -924,6 +924,10 @@ def approval_surrender(self,request,details):
                     'surrender_date' : details.get('surrender_date').strftime('%d/%m/%Y'),
                     'details': details.get('surrender_details'),
                 }
+
+                if not (self.applicant_obj == request.user or request.user in self.allowed_assessors):
+                    raise ValidationError("User not authorised to surrender approval")
+
                 today = timezone.now().date()
                 surrender_date = datetime.datetime.strptime(self.surrender_details['surrender_date'],'%d/%m/%Y')
                 surrender_date = surrender_date.date()