Restrictions for case status change

CoviDok/BLL/User/Managers/CaseManager.cs

@@ -44,7 +44,10 @@ namespace CoviDok.BLL.User.Managers
             if (c == null) throw new KeyNotFoundException();
             if (handler.IsAuthorized(s.Id, c) && s.Type == Api.Role.Ast)
             {
-                Update update = new Update { 
+                if (c.CaseStatus == CaseStatus.Cured)
+                {
+                    Update update = new Update
+                    {
                         CaseId = c.Id,
                         SenderId = s.Id,
                         SenderRole = s.Type,
@@ -53,6 +56,8 @@ namespace CoviDok.BLL.User.Managers
                     };
                     await handler.SetCase(id, CaseStatus.Certified, update);
                 }
+                else throw new InvalidOperationException();
+            }
             else
             {
                 throw new UnauthorizedAccessException();
@@ -64,6 +69,8 @@ namespace CoviDok.BLL.User.Managers
             Case c = await handler.GetCase(id);
             if (c == null) throw new KeyNotFoundException();
             if (s.Id == c.DoctorId)
+            {
+                if (c.CaseStatus == CaseStatus.InProgress)
                 {
                     Update update = new Update
                     {
@@ -75,6 +82,8 @@ namespace CoviDok.BLL.User.Managers
                     };
                     await handler.SetCase(id, CaseStatus.Cured, update);
                 }
+                else throw new InvalidOperationException();
+            }
             else
             {
                 throw new UnauthorizedAccessException();

CoviDok/Controllers/CaseController.cs

@@ -153,6 +153,10 @@ namespace CoviDok.Controllers
             {
                 return NotFound();
             }
+            catch (InvalidOperationException)
+            {
+                return BadRequest();
+            }
         }
         // POST /api/Case/{id}/close
         [HttpPost("{id}/cure")]
@@ -172,6 +176,10 @@ namespace CoviDok.Controllers
             {
                 return NotFound();
             }
+            catch (InvalidOperationException)
+            {
+                return BadRequest();
+            }
         }
 
         // POST /api/Case/filter