do not silently drop review-only settings wne not logged-in

src/route/job_offer/create.rs

@@ -16,7 +16,7 @@ use tempfile::NamedTempFile;
 use url::Url;
 
 use crate::auth::User;
-use crate::error::{MultipartFieldError, PresentationError};
+use crate::error::{LoginRequired, MultipartFieldError, PresentationError};
 use crate::job_offers::error::{EmailError, SaveError};
 use crate::job_offers::{
     Attachment, ConfirmationStatus, JobOffer, JobOfferStatus, JobOffers, Link, MutBorrowedJobOffer,
@@ -185,12 +185,39 @@ pub(crate) async fn create_job_offer<'data, 'config>(
     let token: String =
         rand::distributions::Alphanumeric.sample_string(&mut rand::thread_rng(), 64);
 
+    if user.is_none()
+        && (job_offer_form.backdate.is_some()
+            || job_offer_form.skip_confirmation
+            || job_offer_form.pre_approved
+            || job_offer_form.permanent)
+    {
+        // a reviewer-only option is set, but user is not logged-in as a reviewer
+        // maybe a session just expired or some one is messing with the form
+        return Err(SaveError::LoginRequired(LoginRequired::new()));
+    }
+
     let submission_datetime = user
         .and(job_offer_form.backdate)
         .unwrap_or_else(|| crate::util::chrono_datetime_to_toml_datetime(&now_date));
 
+    let is_permanent = user.is_some() && job_offer_form.permanent;
+
+    let review_status = if user.is_some() && job_offer_form.pre_approved {
+        ReviewStatus::Reviewed
+    } else {
+        ReviewStatus::AwaitingReview
+    };
+
     let skip_confirmation = user.is_some() && job_offer_form.skip_confirmation;
 
+    let confirmation_status = if skip_confirmation {
+        ConfirmationStatus::Confirmed
+    } else {
+        ConfirmationStatus::AwaitingConfirmation {
+            token: token.clone(),
+        }
+    };
+
     let job_offer = JobOffer {
         title: job_offer_form.title,
         offering_party: job_offer_form.offering_party,
@@ -198,23 +225,10 @@ pub(crate) async fn create_job_offer<'data, 'config>(
         contact_info: job_offer_form.contact.to_owned(),
         date_of_submission: submission_datetime,
         date_of_expiry: job_offer_form.expires.map(crate::job_offers::Date),
-        permanent: user.is_some() && job_offer_form.permanent,
+        permanent: is_permanent,
         attachments: job_offer_form.attachments,
         links: job_offer_form.links,
-        status: JobOfferStatus::new(
-            if user.is_some() && job_offer_form.pre_approved {
-                ReviewStatus::Reviewed
-            } else {
-                ReviewStatus::AwaitingReview
-            },
-            if skip_confirmation {
-                ConfirmationStatus::Confirmed
-            } else {
-                ConfirmationStatus::AwaitingConfirmation {
-                    token: token.clone(),
-                }
-            },
-        ),
+        status: JobOfferStatus::new(review_status, confirmation_status),
     };
 
     let created_offer = offers.create_new_offer(now_date, job_offer, config).await?;