fix(api): scavenger shall not touch domains owned by inactive users

api/desecapi/management/commands/scavenge-unused.py

@@ -17,7 +17,8 @@ notice_days_warn = 7
 
 
 class Command(BaseCommand):
-    base_queryset = models.Domain.objects.exclude(renewal_state=models.Domain.RenewalState.IMMORTAL)
+    base_queryset = models.Domain.objects\
+        .exclude(renewal_state=models.Domain.RenewalState.IMMORTAL).filter(owner__is_active=True)
     _rrsets_outer_queryset = models.RRset.objects.filter(domain=OuterRef('pk')).values('domain')  # values() is GROUP BY
     _max_touched = Subquery(_rrsets_outer_queryset.annotate(max_touched=Max('touched')).values('max_touched'))
 

api/desecapi/tests/test_user_management.py

@@ -1139,6 +1139,24 @@ class RenewTestCase(UserManagementTestCase, DomainOwnerTestCase):
             for domain in domains:
                 self.assertLess(Domain.objects.get(pk=domain.pk).renewal_state, Domain.RenewalState.NOTIFIED)
 
+    def test_renew_domain_inactive_user(self):
+        domain = self.my_domains[0]
+        for is_active in (False, None):
+            self.owner.is_active = is_active
+            self.owner.save()
+            for days in [5, 182, 184]:
+                for published_days_ago  in [1, 183+21, 183+28]:
+                    domain.published = timezone.now() - timedelta(days=published_days_ago)
+                    domain.renewal_changed = timezone.now() - timedelta(days=days)
+                    domain.rrset_set.update(touched=domain.renewal_changed)
+                    for renewal_state, _ in Domain.RenewalState.choices:
+                        domain.renewal_state = renewal_state
+                        domain.save()
+
+                        self.assertEqual(Domain.objects.get(pk=domain.pk).renewal_state, renewal_state)
+                        call_command('scavenge-unused')
+                        self.assertEqual(Domain.objects.get(pk=domain.pk).renewal_state, renewal_state)
+
 
 class RenewDynTestCase(RenewTestCase):
     DYN = True