missing condition added, new test added for missing condition

Author: ihsaan-ullah

src/apps/api/tests/test_submissions.py

@@ -129,6 +129,14 @@ def test_super_user_can_delete_submission_you_created(self):
         assert resp.status_code == 204
         assert not Submission.objects.filter(pk=self.existing_submission.pk).exists()
 
+    def test_super_user_can_delete_leaderboard_submission_you_created(self):
+        url = reverse('submission-detail', args=(self.leaderboard_submission.pk,))
+
+        self.client.force_login(self.superuser)
+        resp = self.client.delete(url)
+        assert resp.status_code == 204
+        assert not Submission.objects.filter(pk=self.leaderboard_submission.pk).exists()
+
     def test_cannot_delete_leaderboard_submission_you_created(self):
         url = reverse('submission-detail', args=(self.leaderboard_submission.pk,))
 

src/apps/api/views/submissions.py

@@ -199,23 +199,21 @@ def create(self, request, *args, **kwargs):
 
     def destroy(self, request, *args, **kwargs):
         """
-        - If a user is owner of a submission and submission is not on the leaderboard, user can delete the submission using the delete API
-        - If a user is either super user or admin of the competition of the submission, user can delete the submission
         - If user is neither owner nor admin, user cannot delete the submission
+        - If a user is not admin and is owner of a submission and submission is on the leaderboard, user cannot delete the submission
+        - In rest of the cases i.e. user is admin/super user or user is owner of the submisison and submission is not on the leaderboard, user can delete the submisison
         """
         submission = self.get_object()
 
         is_owner = request.user == submission.owner
         is_super_user_or_competition_admin = self.has_admin_permission(request.user, submission)
 
-        # If user is neither owner nor super user/admin
-        # return permission denied
+        # If user is neither owner nor super user/admin return permission denied
         if not is_owner and not is_super_user_or_competition_admin:
             raise PermissionDenied("You do not have permission to delete this submission!")
 
-        # If user is owner but submission is on the leaderboard
-        # return permission denied
-        if is_owner and submission.leaderboard:
+        # If user is not admin, is owner and submission is on the leaderboard return permission denied
+        if not is_super_user_or_competition_admin and is_owner and submission.leaderboard:
             raise PermissionDenied("You cannot delete a leaderboard submission!")
 
         # Otherwise, delete the submission