Drop GET handling at /seen API endpoint

securedrop/journalist_app/api.py

@@ -317,45 +317,14 @@ def get_all_replies() -> Tuple[flask.Response, int]:
         return jsonify(
             {'replies': [reply.to_json() for reply in replies if reply.source]}), 200
 
-    @api.route("/seen", methods=["GET", "POST"])
+    @api.route("/seen", methods=["POST"])
     @token_required
     def seen() -> Tuple[flask.Response, int]:
         """
         Lists or marks the source conversation items that the journalist has seen.
         """
         user = _authenticate_user_from_auth_header(request)
 
-        if request.method == "GET":
-            seen_files = [
-                {
-                    "file_uuid": f.file.uuid,
-                    "journalist_uuid": f.journalist.uuid if f.journalist_id else None
-                }
-                for f in SeenFile.query.all()
-            ]
-            seen_messages = [
-                {
-                    "message_uuid": f.message.uuid,
-                    "journalist_uuid": f.journalist.uuid if f.journalist_id else None
-                }
-                for f in SeenMessage.query.all()
-            ]
-            seen_replies = [
-                {
-                    "reply_uuid": f.reply.uuid,
-                    "journalist_uuid": f.journalist.uuid if f.journalist_id else None
-                }
-                for f in SeenReply.query.all()
-            ]
-
-            return jsonify(
-                {
-                    "files": seen_files,
-                    "messages": seen_messages,
-                    "replies": seen_replies,
-                }
-            ), 200
-
         if request.method == "POST":
             if request.json is None or not isinstance(request.json, collections.abc.Mapping):
                 abort(400, "Please send requests in valid JSON.")

securedrop/tests/test_journalist_api.py

@@ -1051,13 +1051,6 @@ def test_seen(journalist_app, journalist_api_token, test_files, test_journo, tes
         submissions_url = url_for('api.get_all_submissions')
         headers = get_api_headers(journalist_api_token)
 
-        # check that /seen reports no submissions, but one reply
-        response = app.get(seen_url, headers=headers)
-        assert response.status_code == 200
-        assert len(response.json["files"]) == 0
-        assert len(response.json["messages"]) == 0
-        assert len(response.json["replies"]) == 1
-
         # check that /submissions contains no seen items
         response = app.get(submissions_url, headers=headers)
         assert response.status_code == 200
@@ -1081,32 +1074,6 @@ def test_seen(journalist_app, journalist_api_token, test_files, test_journo, tes
         assert response.status_code == 200
         assert response.json["message"] == "resources marked seen"
 
-        # and check that they are now reported seen
-        response = app.get(seen_url, headers=headers)
-        assert response.status_code == 200
-
-        expected_data = {
-            "files": [
-                {
-                    "file_uuid": file_uuid,
-                    "journalist_uuid": test_journo["uuid"]
-                }
-            ],
-            "messages": [
-                {
-                    "message_uuid": msg_uuid,
-                    "journalist_uuid": test_journo["uuid"]
-                }
-            ],
-            "replies": [
-                {
-                    "reply_uuid": reply_uuid,
-                    "journalist_uuid": test_journo["uuid"]
-                }
-            ],
-        }
-        assert expected_data == response.json
-
         # check that /submissions now contains the seen items
         response = app.get(submissions_url, headers=headers)
         assert response.status_code == 200
@@ -1157,13 +1124,6 @@ def test_seen_bad_requests(journalist_app, journalist_api_token):
         seen_url = url_for('api.seen')
         headers = get_api_headers(journalist_api_token)
 
-        response = app.get(seen_url, headers=headers)
-        assert response.status_code == 200
-
-        assert len(response.json["files"]) == 0
-        assert len(response.json["messages"]) == 0
-        assert len(response.json["replies"]) == 0
-
         # invalid JSON
         data = "not a mapping"
         response = app.post(seen_url, data=json.dumps(data), headers=headers)