Fixes #2421 - API creates empty tickets without articles if data is missing

app/controllers/concerns/creates_ticket_articles.rb

@@ -13,7 +13,7 @@ module CreatesTicketArticles
     subtype = params.delete(:subtype)
 
     # check min. params
-    raise Exceptions::UnprocessableEntity, __('Need at least article: { body: "some text" }') if !params[:body]
+    raise Exceptions::UnprocessableEntity, __('Need at least article: { body: "some text" }') if params[:body].blank?
 
     # fill default values
     if params[:type_id].blank? && params[:type].blank?

app/controllers/tickets_controller.rb

@@ -72,6 +72,9 @@ class TicketsController < ApplicationController
 
   # POST /api/v1/tickets
   def create
+    ticket = nil
+
+    Transaction.execute do # rubocop:disable Metrics/BlockLength
       customer = {}
       if params[:customer].instance_of?(ActionController::Parameters)
         customer = params[:customer]
@@ -140,15 +143,8 @@ class TicketsController < ApplicationController
       ticket = Ticket.new(clean_params)
       authorize!(ticket, :create?)
 
-    # check if article is given
-    if !params[:article]
-      render json: { error: 'article hash is missing' }, status: :unprocessable_entity
-      return
-    end
-
       # create ticket
       ticket.save!
-    ticket.with_lock do
 
       # create tags if given
       if params[:tags].present?
@@ -170,7 +166,7 @@ class TicketsController < ApplicationController
       if params[:article]
         article_create(ticket, params[:article])
       end
-    end
+
       # create links (e. g. in case of ticket split)
       # links: {
       #   Ticket: {
@@ -201,6 +197,7 @@ class TicketsController < ApplicationController
           end
         end
       end
+    end
 
     if response_expand?
       result = ticket.reload.attributes_with_association_names

spec/requests/ticket_spec.rb

@@ -101,12 +101,45 @@ RSpec.describe 'Ticket', type: :request do
         article:     {},
       }
       authenticated_as(agent)
-      post '/api/v1/tickets', params: params, as: :json
+      expect { post '/api/v1/tickets', params: params, as: :json }.not_to change(Ticket, :count)
       expect(response).to have_http_status(:unprocessable_entity)
       expect(json_response).to be_a_kind_of(Hash)
       expect(json_response['error']).to eq('Need at least article: { body: "some text" }')
     end
 
+    it 'does ticket create with agent - article.body set to empty string (01.03)' do
+      params = {
+        title:       'a new ticket #3',
+        group:       ticket_group.name,
+        priority:    '2 normal',
+        state:       'new',
+        customer_id: customer.id,
+        article:     { body: " \n " },
+      }
+      authenticated_as(agent)
+      expect { post '/api/v1/tickets', params: params, as: :json }.not_to change(Ticket, :count)
+      expect(response).to have_http_status(:unprocessable_entity)
+      expect(json_response).to be_a_kind_of(Hash)
+      expect(json_response['error']).to eq('Need at least article: { body: "some text" }')
+    end
+
+    it 'does ticket create with agent - missing article (01.03)' do
+      params = {
+        title:       'a new ticket #3',
+        group:       ticket_group.name,
+        priority:    '2 normal',
+        state:       'new',
+        customer_id: customer.id
+      }
+      authenticated_as(agent)
+      expect { post '/api/v1/tickets', params: params, as: :json }.to change(Ticket, :count).by(1)
+      expect(response).to have_http_status(:created)
+      expect(json_response).to be_a_kind_of(Hash)
+
+      ticket = Ticket.find(json_response['id'])
+      expect(ticket.articles).to be_empty
+    end
+
     it 'does ticket create with agent - minimal article (01.03)' do
       params = {
         title:       'a new ticket #3',
@@ -151,30 +184,6 @@ RSpec.describe 'Ticket', type: :request do
       expect(json_response['created_by_id']).to eq(agent.id)
     end
 
-    it 'does ticket create with empty article body' do
-      params = {
-        title:    'a new ticket with empty article body',
-        group:    ticket_group.name,
-        priority: '2 normal',
-        state:    'new',
-        customer: customer.email,
-        article:  { body: '' }
-      }
-      authenticated_as(agent)
-      post '/api/v1/tickets', params: params, as: :json
-      expect(response).to have_http_status(:created)
-      expect(json_response).to be_a_kind_of(Hash)
-      expect(json_response['state_id']).to eq(Ticket::State.lookup(name: 'new').id)
-      expect(json_response['title']).to eq('a new ticket with empty article body')
-      expect(json_response['customer_id']).to eq(customer.id)
-      expect(json_response['updated_by_id']).to eq(agent.id)
-      expect(json_response['created_by_id']).to eq(agent.id)
-      ticket = Ticket.find(json_response['id'])
-      expect(ticket.articles.count).to eq(1)
-      article = ticket.articles.first
-      expect(article.body).to eq('')
-    end
-
     it 'does ticket create with agent - wrong owner_id - 0 (01.05)' do
       params = {
         title:       'a new ticket #4',