Actually prevent editing of closed meetings

https://community.openproject.org/projects/meetings-stream/work_packages/74372/activity

Author: oliverguenther

modules/meeting/app/contracts/meetings/update_contract.rb

@@ -35,6 +35,7 @@ class UpdateContract < BaseContract
 
     validate :user_allowed_to_edit_in_source_project
     validate :user_allowed_to_edit_in_destination_project
+    validate :meeting_is_editable
     validate :valid_rescheduling_date, if: -> { check_reschedule? }
 
     attribute :lock_version do
@@ -57,6 +58,12 @@ def user_allowed_to_edit_in_destination_project
       end
     end
 
+    def meeting_is_editable
+      return unless user.allowed_in_project?(:edit_meetings, model.project)
+
+      errors.add :base, I18n.t(:text_meeting_not_editable_anymore) unless model.editable?(user)
+    end
+
     def valid_rescheduling_date # rubocop:disable Metrics/AbcSize
       if model.start_time < Time.zone.now
         errors.add :start_date, :after_today

modules/meeting/spec/contracts/meetings/update_contract_spec.rb

@@ -66,6 +66,14 @@
 
       it_behaves_like "contract is invalid", base: :error_conflict
     end
+
+    context "when meeting is closed" do
+      before do
+        meeting.update_column(:state, :closed)
+      end
+
+      it_behaves_like "contract is invalid", base: I18n.t(:text_meeting_not_editable_anymore)
+    end
   end
 
   context "without permission" do

modules/meeting/spec/requests/meetings_spec.rb

@@ -65,6 +65,38 @@
     end
   end
 
+  describe "update_details" do
+    let(:details_params) do
+      {
+        project_id: project.id,
+        id: meeting.id,
+        meeting: {
+          title: "Modified title",
+          start_date: Date.current.to_s,
+          duration: "1h",
+          location: "Modified location",
+          lock_version: meeting.lock_version
+        }
+      }
+    end
+
+    context "when meeting is closed" do
+      before do
+        meeting.update_column(:state, :closed)
+      end
+
+      it "rejects the update" do
+        expect do
+          put update_details_project_meeting_path(project, meeting),
+              params: details_params,
+              as: :turbo_stream
+        end.not_to change { meeting.reload.attributes.slice("title", "start_time", "duration", "location") }
+
+        expect(response).to have_http_status(:bad_request)
+      end
+    end
+  end
+
   describe "copy" do
     let(:base_params) do
       {