invitation can only be accepted by user with matching DOD ID

tests/domain/test_invitations.py

@@ -2,7 +2,7 @@ import datetime
 import pytest
 import re
 
-from atst.domain.invitations import Invitations, InvitationError
+from atst.domain.invitations import Invitations, InvitationError, WrongUserError
 from atst.models.invitation import Status
 
 from tests.factories import (
@@ -31,7 +31,7 @@ def test_accept_invitation():
     ws_role = WorkspaceRoleFactory.create(user=user, workspace=workspace)
     invite = Invitations.create(ws_role, workspace.owner, user)
     assert invite.is_pending
-    accepted_invite = Invitations.accept(invite.token)
+    accepted_invite = Invitations.accept(user, invite.token)
     assert accepted_invite.is_accepted
 
 
@@ -43,7 +43,7 @@ def test_accept_expired_invitation():
         user_id=user.id, expiration_time=expiration_time, status=Status.PENDING
     )
     with pytest.raises(InvitationError):
-        Invitations.accept(invite.token)
+        Invitations.accept(user, invite.token)
 
     assert invite.is_rejected
 
@@ -52,11 +52,20 @@ def test_accept_rejected_invite():
     user = UserFactory.create()
     invite = InvitationFactory.create(user_id=user.id, status=Status.REJECTED)
     with pytest.raises(InvitationError):
-        Invitations.accept(invite.token)
+        Invitations.accept(user, invite.token)
 
 
 def test_accept_revoked_invite():
     user = UserFactory.create()
     invite = InvitationFactory.create(user_id=user.id, status=Status.REVOKED)
     with pytest.raises(InvitationError):
-        Invitations.accept(invite.token)
+        Invitations.accept(user, invite.token)
+
+
+def test_wrong_user_accepts_invitation():
+    user = UserFactory.create()
+    wrong_user = UserFactory.create()
+    invite = InvitationFactory.create(user_id=user.id)
+    with pytest.raises(WrongUserError):
+        Invitations.accept(wrong_user, invite.token)
+

tests/routes/test_workspaces.py

@@ -355,3 +355,19 @@ def test_user_who_has_not_accepted_workspace_invite_cannot_view(client, user_ses
     user_session(user)
     response = client.get("/workspaces/{}/projects".format(workspace.id))
     assert response.status_code == 404
+
+
+def test_user_accepts_invite_with_wrong_dod_id(client, user_session):
+    workspace = WorkspaceFactory.create()
+    user = UserFactory.create()
+    different_user = UserFactory.create()
+    ws_role = WorkspaceRoleFactory.create(
+        user=user, workspace=workspace, status=WorkspaceRoleStatus.PENDING
+    )
+    invite = InvitationFactory.create(
+        user_id=user.id, workspace_role_id=ws_role.id
+    )
+    user_session(different_user)
+    response = client.get(url_for("workspaces.accept_invitation", token=invite.token))
+
+    assert response.status_code == 404