Avoid using assert statements for actual business logic:

Depending on what flags the python interpreter is launched with, they may
not even get checked when running in production.

opengever/dossiertransfer/api/base.py

@@ -34,7 +34,9 @@ def serialize(self, transfer, full_content=False):
             (transfer, getRequest()), ISerializeToJson)()
 
         if full_content:
-            assert self.has_valid_token()
+            if not self.has_valid_token():
+                raise Unauthorized
+
             with elevated_privileges():
                 serialized['content'] = FullTransferContentSerializer(transfer)()
 

opengever/dossiertransfer/api/get.py

@@ -97,7 +97,6 @@ def stream_document_blob(self):
                 if document_uid not in transfer.documents:
                     raise Unauthorized
 
-            assert len(brains) == 1
             document = brains[0].getObject()
             namedfile = document.file
 

opengever/dossiertransfer/api/post.py

@@ -69,8 +69,8 @@ def reply(self):
         session.flush()
 
         token = transfer.issue_token()
-        assert transfer.token == token
-        assert transfer.is_valid_token(token)
+        if not (transfer.token == token and transfer.is_valid_token(token)):
+            raise Unauthorized
 
         serialized_transfer = self.serialize(transfer)
 

opengever/dossiertransfer/api/serializers.py

@@ -116,7 +116,10 @@ def __call__(self):
             serialized_dossiers.append(serialized)
 
         # We only add participations for the root dossier
-        assert serialized_dossiers[0]['UID'] == self.transfer.root
+        if serialized_dossiers[0]['UID'] != self.transfer.root:
+            raise RuntimeError(
+                'Unexpected first dossier, expected it to match root dossier')
+
         serialized_dossiers[0]['participations'] = ParticipationsSerializer(self.transfer)()
 
         return serialized_dossiers