Repository: City-of-Helsinki/linkedevents

Issue:
Prevent editing past events



Discussion:

Resolving patch:
diff --git a/events/api.py b/events/api.py
--- a/events/api.py
+++ b/events/api.py
@@ -29,7 +29,7 @@
 from rest_framework.settings import api_settings
 from rest_framework.reverse import reverse
 from rest_framework.response import Response
-from rest_framework.exceptions import ParseError
+from rest_framework.exceptions import ParseError, PermissionDenied as DRFPermissionDenied
 from rest_framework.views import get_view_name as original_get_view_name
 
 
@@ -1006,6 +1006,9 @@ def update(self, instance, validated_data):
         offers = validated_data.pop('offers', None)
         links = validated_data.pop('external_links', None)
 
+        if instance.end_time and instance.end_time < timezone.now():
+            raise DRFPermissionDenied(_('Cannot edit a past event.'))
+
         # The API only allows scheduling and cancelling events.
         # POSTPONED and RESCHEDULED may not be set, but should be allowed in already set instances.
         if validated_data.get('event_status') in (Event.Status.POSTPONED, Event.Status.RESCHEDULED):


Test patch:
diff --git a/events/tests/conftest.py b/events/tests/conftest.py
--- a/events/tests/conftest.py
+++ b/events/tests/conftest.py
@@ -192,7 +192,7 @@ def event(place, user):
         data_source=place.data_source, publisher=place.publisher,
         last_modified_by=user,
         start_time=timezone.now(),
-        end_time=timezone.now(),
+        end_time=timezone.now() + timedelta(hours=1),
         short_description='short desc',
         description='desc'
     )
@@ -225,7 +225,7 @@ def event2(place2, user2):
         data_source=place2.data_source, publisher=place2.publisher,
         last_modified_by=user2,
         start_time=timezone.now(),
-        end_time=timezone.now(),
+        end_time=timezone.now() + timedelta(hours=1),
         short_description='short desc',
         description='desc'
     )
@@ -237,7 +237,7 @@ def event3(place3, user):
         data_source=place3.data_source, publisher=place3.publisher,
         last_modified_by=user,
         start_time=timezone.now(),
-        end_time=timezone.now(),
+        end_time=timezone.now() + timedelta(hours=1),
         short_description='short desc',
         description='desc'
     )
diff --git a/events/tests/test_event_put.py b/events/tests/test_event_put.py
--- a/events/tests/test_event_put.py
+++ b/events/tests/test_event_put.py
@@ -360,7 +360,6 @@ def test__wrong_api_key_cannot_update_an_event(api_client, event, complex_event_
     detail_url = reverse('event-detail', kwargs={'pk': event.pk})
     response = update_with_put(api_client, detail_url, complex_event_dict,
                                credentials={'apikey': other_data_source.api_key})
-    print(response.data)
     assert response.status_code == 403
 
 
@@ -437,3 +436,16 @@ def test_multiple_event_update_second_fails(api_client, minimal_event_dict, user
 
     # verify that first event isn't updated either
     assert event_names == {'testing', 'testing_2'}
+
+
+@pytest.mark.django_db
+def test_cannot_edit_events_in_the_past(api_client, event, minimal_event_dict, user):
+    api_client.force_authenticate(user)
+
+    event.start_time = timezone.now() - timedelta(days=2)
+    event.end_time = timezone.now() - timedelta(days=1)
+    event.save(update_fields=('start_time', 'end_time'))
+
+    response = api_client.put(reverse('event-detail', kwargs={'pk': event.id}), minimal_event_dict, format='json')
+    assert response.status_code == 403
+    assert 'Cannot edit a past event' in str(response.content)