fix: Validate input data for account status updates

apps/accounts/api/automations/gather_account.py

@@ -90,14 +90,16 @@ class GatheredAccountViewSet(OrgBulkModelViewSet):
 
     @action(methods=["put"], detail=False, url_path="status")
     def status(self, request, *args, **kwargs):
-        ids = request.data.get('ids', [])
-        new_status = request.data.get("status")
+        serializer = self.get_serializer(data=request.data)
+        if not serializer.is_valid():
+            return Response(serializer.errors, status=status.HTTP_400_BAD_REQUEST)
+        validated_data = serializer.validated_data
+        ids = validated_data.get('ids', [])
+        new_status = validated_data.get('status')
         updated_instances = GatheredAccount.objects.filter(id__in=ids).select_related('asset')
-
         if new_status == "confirmed":
             GatheredAccount.sync_accounts(updated_instances)
             updated_instances.update(present=True)
-
         updated_instances.update(status=new_status)
         return Response(status=status.HTTP_200_OK)
 

apps/accounts/serializers/automations/gather_account.py

@@ -7,6 +7,7 @@ from accounts.models import GatherAccountsAutomation
 from accounts.models import GatheredAccount
 from accounts.serializers.account.account import AccountAssetSerializer as _AccountAssetSerializer
 from accounts.serializers.account.base import BaseAccountSerializer
+from common.const import ConfirmOrIgnore
 from orgs.mixins.serializers import BulkOrgResourceModelSerializer
 from .base import BaseAutomationSerializer
 
@@ -63,9 +64,12 @@ class DiscoverAccountSerializer(BulkOrgResourceModelSerializer):
         return queryset
 
 
-class DiscoverAccountActionSerializer(DiscoverAccountSerializer):
-    class Meta(DiscoverAccountSerializer.Meta):
-        read_only_fields = list(set(DiscoverAccountSerializer.Meta.read_only_fields) - {'status'})
+class DiscoverAccountActionSerializer(serializers.Serializer):
+    ids = serializers.ListField(child=serializers.UUIDField(), required=True)
+    status = serializers.ChoiceField(choices=ConfirmOrIgnore.choices, default=ConfirmOrIgnore.pending, allow_blank=True)
+
+    class Meta:
+        fields = ['ids', 'status']
 
 
 class DiscoverAccountDetailsSerializer(serializers.Serializer):