invitation can only be accepted by user with matching DOD ID

tests/domain/test_invitations.py

@@ -2,7 +2,7 @@ import datetime
 import pytest
 import re
 
-from atst.domain.invitations import Invitations, InvitationError
+from atst.domain.invitations import Invitations, InvitationError, WrongUserError
 from atst.models.invitation import Status
 
 from tests.factories import (
@@ -31,7 +31,7 @@ def test_accept_invitation():
     ws_role = WorkspaceRoleFactory.create(user=user, workspace=workspace)
     invite = Invitations.create(ws_role, workspace.owner, user)
     assert invite.is_pending
-    accepted_invite = Invitations.accept(invite.token)
+    accepted_invite = Invitations.accept(user, invite.token)
     assert accepted_invite.is_accepted
 
 
@@ -43,7 +43,7 @@ def test_accept_expired_invitation():
         user_id=user.id, expiration_time=expiration_time, status=Status.PENDING
     )
     with pytest.raises(InvitationError):
-        Invitations.accept(invite.token)
+        Invitations.accept(user, invite.token)
 
     assert invite.is_rejected
 
@@ -52,11 +52,20 @@ def test_accept_rejected_invite():
     user = UserFactory.create()
     invite = InvitationFactory.create(user_id=user.id, status=Status.REJECTED)
     with pytest.raises(InvitationError):
-        Invitations.accept(invite.token)
+        Invitations.accept(user, invite.token)
 
 
 def test_accept_revoked_invite():
     user = UserFactory.create()
     invite = InvitationFactory.create(user_id=user.id, status=Status.REVOKED)
     with pytest.raises(InvitationError):
-        Invitations.accept(invite.token)
+        Invitations.accept(user, invite.token)
+
+
+def test_wrong_user_accepts_invitation():
+    user = UserFactory.create()
+    wrong_user = UserFactory.create()
+    invite = InvitationFactory.create(user_id=user.id)
+    with pytest.raises(WrongUserError):
+        Invitations.accept(wrong_user, invite.token)
+