fix(import): reject archived accounts when importing through the API

The upload form only lists active accounts, but the API accepted any account
the user can access, archived ones included.

app/apps/api/serializers/imports.py

@@ -43,7 +43,7 @@ class ImportFileSerializer(serializers.Serializer):
     )
     file = serializers.FileField()
     account_id = serializers.PrimaryKeyRelatedField(
-        queryset=Account.objects.all(),
+        queryset=Account.objects.filter(is_archived=False),
         source="account",
         required=False,
         allow_null=True,
@@ -53,7 +53,7 @@ class ImportFileSerializer(serializers.Serializer):
         super().__init__(*args, **kwargs)
         # Reload the querysets to get an updated version with the requesting user
         self.fields["profile_id"].queryset = ImportProfile.objects.all()
-        self.fields["account_id"].queryset = Account.objects.all()
+        self.fields["account_id"].queryset = Account.objects.filter(is_archived=False)
 
     def validate(self, data):
         if data.get("account") and not data["profile"].imports_transactions:

app/apps/import_app/tests/test_run_account.py

@@ -359,6 +359,16 @@ class ImportRunAccountAPITests(ImportRunAccountTestCase):
         self.assertIn("account_id", response.data)
         mock_defer.assert_not_called()
 
+    @patch("apps.api.views.imports.process_import.defer")
+    def test_api_rejects_an_archived_account(self, mock_defer):
+        response = self._post(
+            self.private_profile, account_id=self.archived_account.id
+        )
+
+        self.assertEqual(response.status_code, status.HTTP_400_BAD_REQUEST)
+        self.assertIn("account_id", response.data)
+        mock_defer.assert_not_called()
+
     @patch("apps.api.views.imports.process_import.defer")
     def test_api_rejects_an_account_for_profiles_not_importing_transactions(
         self, mock_defer