refactor: remove UpdateAgreementView and its URL path from user management 🔨

api/urls.py

@@ -23,7 +23,6 @@ from .views import (
     UserVerifyAPIView,
     UserUpdateAPIView,
     UserRejectAPIView,
-    UpdateAgreementView,
 )
 
 
@@ -46,11 +45,6 @@ urlpatterns = [
     path("users/temp/filter/", filter_temporary_user, name="filter-temporary-users"),
     # User verification flow
     path("users/<int:pk>/verify/", UserVerifyAPIView.as_view(), name="user-verify"),
-    path(
-        "users/<int:pk>/agreement/",
-        UpdateAgreementView.as_view(),
-        name="user-agreement",
-    ),
     path("users/<int:pk>/reject/", UserRejectAPIView.as_view(), name="user-reject"),
     path("healthcheck/", healthcheck, name="healthcheck"),
     path("test/", test_email, name="testemail"),

api/views.py

@@ -353,19 +353,6 @@ class UserUpdateAPIView(StaffEditorPermissionMixin, generics.UpdateAPIView):
             data=request.data,
             partial=True,
         )
-        serializer.is_valid(raise_exception=True)
-        user.save()
-        return super().update(request, *args, **kwargs)
-
-
-class UpdateAgreementView(StaffEditorPermissionMixin, generics.UpdateAPIView):
-    serializer_class = UserUpdateSerializer
-    queryset = User.objects.all()
-    lookup_field = "pk"
-
-    def update(self, request, *args, **kwargs):
-        user_id = kwargs.get("pk")
-        user = get_object_or_404(User, pk=user_id)
         agreement_file = request.data.get("agreement_file")
         if not agreement_file:
             return Response(
@@ -384,21 +371,9 @@ class UpdateAgreementView(StaffEditorPermissionMixin, generics.UpdateAPIView):
                 {"message": "Invalid file type. Only PDF files are allowed."},
                 status=status.HTTP_400_BAD_REQUEST,
             )
-        if request.user != user and (
+        if agreement_file:
-            not request.user.is_authenticated
+            user.agreement = agreement_file
-            or not getattr(request.user, "is_admin", False)
-        ):
-            return Response(
-                {"message": "You are not authorized to update this user."},
-                status=status.HTTP_403_FORBIDDEN,
-            )
-        serializer = self.get_serializer(
-            user,
-            data=request.data,
-            partial=True,
-        )
         serializer.is_valid(raise_exception=True)
-        user.agreement = agreement_file
         user.save()
         return super().update(request, *args, **kwargs)