Prohibit un-embargo if dandiset has active uploads

dandiapi/api/services/embargo/__init__.py

@@ -12,7 +12,11 @@
 from dandiapi.api.services.asset.exceptions import DandisetOwnerRequiredError
 from dandiapi.api.storage import get_boto_client
 
-from .exceptions import AssetBlobEmbargoedError, DandisetNotEmbargoedError
+from .exceptions import (
+    AssetBlobEmbargoedError,
+    DandisetActiveUploadsError,
+    DandisetNotEmbargoedError,
+)
 
 if TYPE_CHECKING:
     from django.contrib.auth.models import User
@@ -75,6 +79,9 @@ def unembargo_dandiset(*, user: User, dandiset: Dandiset):
     if not user.has_perm('owner', dandiset):
         raise DandisetOwnerRequiredError
 
+    if dandiset.uploads.count():
+        raise DandisetActiveUploadsError
+
     # A scheduled task will pick up any new dandisets with this status and email the admins to
     # initiate the un-embargo process
     dandiset.embargo_status = Dandiset.EmbargoStatus.UNEMBARGOING

dandiapi/api/services/embargo/exceptions.py

@@ -13,3 +13,8 @@ class AssetBlobEmbargoedError(DandiError):
 class DandisetNotEmbargoedError(DandiError):
     http_status_code = status.HTTP_400_BAD_REQUEST
     message = 'Dandiset not embargoed'
+
+
+class DandisetActiveUploadsError(DandiError):
+    http_status_code = status.HTTP_400_BAD_REQUEST
+    message = 'Dandiset un-embargo not allowed with active uploads'

dandiapi/api/tests/test_unembargo.py

@@ -39,3 +39,18 @@ def test_unembargo_dandiset_sends_emails(
     assert 'un-embargo' in mailoutbox[0].subject
     assert dandiset.identifier in mailoutbox[0].message().get_payload()
     assert user.username in mailoutbox[0].message().get_payload()
+
+
+@pytest.mark.django_db()
+def test_unembargo_dandiset_lingering_uploads(
+    api_client, user, dandiset_factory, draft_version_factory, upload_factory
+):
+    dandiset = dandiset_factory(embargo_status=Dandiset.EmbargoStatus.EMBARGOED)
+    draft_version_factory(dandiset=dandiset)
+    upload_factory(dandiset=dandiset)
+
+    assign_perm('owner', user, dandiset)
+    api_client.force_authenticate(user=user)
+
+    resp = api_client.post(f'/api/dandisets/{dandiset.identifier}/unembargo/')
+    assert resp.status_code == 400