apply: Clean back_url after cancelling a job application

itou/www/apply/views/process_views.py

@@ -13,7 +13,7 @@
 from django.http import HttpResponse, HttpResponseForbidden, HttpResponseRedirect
 from django.shortcuts import get_object_or_404, render
 from django.template import loader
-from django.urls import reverse, reverse_lazy
+from django.urls import resolve, reverse, reverse_lazy
 from django.utils import formats, timezone
 from django.views.decorators.http import require_POST
 from django.views.generic.base import TemplateView
@@ -637,6 +637,11 @@ def cancel(request, job_application_id):
     check_waiting_period(job_application)
     next_url = reverse("apply:details_for_company", kwargs={"job_application_id": job_application.pk})
 
+    session_key = JOB_APP_DETAILS_FOR_COMPANY_BACK_URL_KEY % job_application.pk
+    if back_url := request.session.get(session_key):
+        if back_url.startswith(reverse("employees:detail", args=(job_application.job_seeker.public_id,))):
+            request.session.pop(session_key)
+
     if not job_application.can_be_cancelled:
         messages.error(request, "Vous ne pouvez pas annuler cette embauche.")
         return HttpResponseRedirect(next_url)

tests/www/apply/test_process.py

@@ -1539,6 +1539,29 @@ def test_cancel(self, client, eligibility_trait, expected_msg):
         assert job_application.state.is_cancelled
         assertMessages(response, [messages.Message(messages.SUCCESS, "L'embauche a bien été annulée.")])
 
+    def test_cancel_clean_back_url(self, client):
+        job_application = JobApplicationFactory(with_approval=True, to_company__subject_to_eligibility=True)
+        employer = job_application.to_company.members.first()
+        client.force_login(employer)
+
+        employee_url = reverse("employees:detail", args=(job_application.job_seeker.public_id,))
+        response = client.get(employee_url)
+
+        detail_url = reverse("apply:details_for_company", kwargs={"job_application_id": job_application.pk})
+        detail_url_with_back_url = f"{detail_url}?back_url={urlencode_filter(employee_url)}"
+        assertContains(response, detail_url_with_back_url)
+
+        client.get(detail_url_with_back_url)
+        assertContains(response, employee_url)
+
+        cancel_url = reverse("apply:cancel", kwargs={"job_application_id": job_application.pk})
+        response = client.post(cancel_url)
+        assertRedirects(response, detail_url)
+
+        response = client.get(detail_url)
+        # employee_url is not available anymore so we cleaned it
+        assertNotContains(response, employee_url)
+
     def test_cannot_cancel(self, client):
         job_application = JobApplicationFactory(
             with_approval=True,