More coverage.

2 files changed, 25 insertions, 2 deletions

diff --git a/src/mailman/rest/sub_moderation.py b/src/mailman/rest/sub_moderation.py
index 92ee7ff10..b0ffdc8c1 100644
--- a/src/mailman/rest/sub_moderation.py
+++ b/src/mailman/rest/sub_moderation.py
@@ -79,7 +79,7 @@ class IndividualRequest(_ModerationBase):
             bad_request(response, str(error))
             return
         action = arguments['action']
-        if action is Action.defer:
+        if action in (Action.defer, Action.hold):
             # At least see if the token is in the database.
             pendable = self._pendings.confirm(self._token, expunge=False)
             if pendable is None:
@@ -100,7 +100,8 @@ class IndividualRequest(_ModerationBase):
                 not_found(response)
             else:
                 no_content(response)
-        elif action is Action.reject:
+        else:
+            assert action is Action.reject, action
             # Like discard but sends a rejection notice to the user.
             pendable = self._pendings.confirm(self._token, expunge=True)
             if pendable is None:
diff --git a/src/mailman/rest/tests/test_moderation.py b/src/mailman/rest/tests/test_moderation.py
index d424d8690..0100c57ba 100644
--- a/src/mailman/rest/tests/test_moderation.py
+++ b/src/mailman/rest/tests/test_moderation.py
@@ -341,3 +341,25 @@ class TestSubscriptionModeration(unittest.TestCase):
                      '/requests/bogus',
                      dict(action='reject'))
         self.assertEqual(cm.exception.code, 404)
+
+    def test_hold_keeps_holding(self):
+        # POST to the request to continue holding it.
+        with transaction():
+            token, token_owner, member = self._registrar.register(self._anne)
+        # Anne's subscription request got held.
+        self.assertIsNone(member)
+        # Clear out the virgin queue, which currently contains the
+        # confirmation message sent to Anne.
+        get_queue_messages('virgin')
+        url = 'http://localhost:9001/3.0/lists/ant@example.com/requests/{}'
+        content, response = call_api(url.format(token), dict(
+            action='hold',
+            ))
+        self.assertEqual(response.status, 204)
+        # Anne is not a member.
+        self.assertIsNone(self._mlist.members.get_member('anne@example.com'))
+        # The request URL still exists.
+        content, response = call_api(url.format(token), dict(
+                action='defer',
+                ))
+        self.assertEqual(response.status, 204)