Fix missing product validation and API queries specifying products

features/news_api_search.feature

@@ -673,3 +673,53 @@ Feature: News API News Search
          {"body_html": "Once upon a time there was a aardvark that could not swim"}
      ]}
      """
+
+  Scenario: search by not allowed product raises error
+    Given "products"
+        """
+        [{"name": "A Product",
+        "decsription": "a product for text",
+        "companies" : [
+          "#companies._id#"
+        ],
+        "query": "aardvark",
+        "product_type": "news_api"
+        }]
+        """
+    When we get "news/search?start_date=now-10d&products=111111111111111111111111"
+    Then we get response code 400
+
+  Scenario: search by not empty product raises error
+    Given "products"
+        """
+        [{"name": "A Product",
+        "decsription": "a product for text",
+        "companies" : [
+          "#companies._id#"
+        ],
+        "query": "aardvark",
+        "product_type": "news_api"
+        }]
+        """
+    Given "items"
+        """
+        [
+            {
+                "body_html": "Three aardvark story",
+                "versioncreated": "#DATE-3#",
+                "headline": "Headline 1",
+                "products": [
+                    {
+                        "code": "#products._id#",
+                        "name": "A Product"
+                    },
+                    {
+                        "code": "1234",
+                        "name": "Product b"
+                    }
+                ]
+            }
+        ]
+        """
+    When we get "news/search?start_date=now-10d&products="
+    Then we get response code 400

newsroom/news_api/news/search_service.py

@@ -231,6 +231,17 @@ def validate_request(self, search):
         if not search.company:
             raise SuperdeskApiError.forbiddenError()
 
+        # Check if 'products' argument is has been passed
+        products_arg = search.args.get('products')
+        if products_arg:
+            valid_product_ids = {str(c.get('_id')) for c in search.products}
+            requested_products = products_arg.split(',')
+            if not all(product in valid_product_ids for product in requested_products):
+                raise BadParameterValueError('Bad product value')
+        # Make sure it has a value
+        elif products_arg == '':
+            raise BadParameterValueError('Bad product value')
+
         self.validate_page(search)
 
     def validate_include_exclude_fields(self, search):