From 63350469d0eb8b3d12d10c78ab9208a19c033d9b Mon Sep 17 00:00:00 2001
From: Lance Edgar <lance@edbob.org>
Date: Tue, 2 Feb 2021 18:58:46 -0600
Subject: [PATCH] Prevent updates to batch rows, if batch is immutable

probably need a lot more support for this elsewhere; this is all i needed for
the moment though..
---
 tailbone/api/batch/core.py     | 7 ++++++-
 tailbone/api/batch/ordering.py | 5 ++++-
 tailbone/api/master.py         | 8 ++++++--
 3 files changed, 16 insertions(+), 4 deletions(-)

diff --git a/tailbone/api/batch/core.py b/tailbone/api/batch/core.py
index 1200f703..a2f44596 100644
--- a/tailbone/api/batch/core.py
+++ b/tailbone/api/batch/core.py
@@ -2,7 +2,7 @@
 ################################################################################
 #
 #  Rattail -- Retail Software Framework
-#  Copyright © 2010-2020 Lance Edgar
+#  Copyright © 2010-2021 Lance Edgar
 #
 #  This file is part of Rattail.
 #
@@ -117,6 +117,7 @@ class APIBatchView(APIBatchMixin, APIMasterView):
             'executed_display': self.pretty_datetime(executed) if executed else None,
             'executed_by_uuid': batch.executed_by_uuid,
             'executed_by_display': six.text_type(batch.executed_by or ''),
+            'mutable': self.handler.is_mutable(batch),
         }
 
     def create_object(self, data):
@@ -268,6 +269,7 @@ class APIBatchRowView(APIBatchMixin, APIMasterView):
             'batch_description': batch.description,
             'batch_complete': batch.complete,
             'batch_executed': bool(batch.executed),
+            'batch_mutable': self.handler.is_mutable(batch),
             'sequence': row.sequence,
             'status_code': row.status_code,
             'status_display': row.STATUS.get(row.status_code, six.text_type(row.status_code)),
@@ -280,6 +282,9 @@ class APIBatchRowView(APIBatchMixin, APIMasterView):
         Invokes the batch handler's ``refresh_row()`` method after updating the
         row's field data per usual.
         """
+        if not self.handler.is_mutable(row.batch):
+            return {'error': "Batch is not mutable"}
+
         # update row per usual
         row = super(APIBatchRowView, self).update_object(row, data)
 
diff --git a/tailbone/api/batch/ordering.py b/tailbone/api/batch/ordering.py
index 031bccdf..21de8da0 100644
--- a/tailbone/api/batch/ordering.py
+++ b/tailbone/api/batch/ordering.py
@@ -2,7 +2,7 @@
 ################################################################################
 #
 #  Rattail -- Retail Software Framework
-#  Copyright © 2010-2020 Lance Edgar
+#  Copyright © 2010-2021 Lance Edgar
 #
 #  This file is part of Rattail.
 #
@@ -267,6 +267,9 @@ class OrderingBatchRowViews(APIBatchRowView):
 
         Note that the "normal" logic for this method is not invoked at all.
         """
+        if not self.handler.is_mutable(row.batch):
+            return {'error': "Batch is not mutable"}
+
         self.handler.update_row_quantity(row, **data)
         return row
 
diff --git a/tailbone/api/master.py b/tailbone/api/master.py
index f215bee1..775292bc 100644
--- a/tailbone/api/master.py
+++ b/tailbone/api/master.py
@@ -2,7 +2,7 @@
 ################################################################################
 #
 #  Rattail -- Retail Software Framework
-#  Copyright © 2010-2020 Lance Edgar
+#  Copyright © 2010-2021 Lance Edgar
 #
 #  This file is part of Rattail.
 #
@@ -345,8 +345,12 @@ class APIMasterView(APIView):
         # assume our data comes only from request JSON body
         data = self.request.json_body
 
-        # update and return data for object
+        # try to update data for object, returning error as necessary
         obj = self.update_object(obj, data)
+        if isinstance(obj, dict) and 'error' in obj:
+            return {'error': obj['error']}
+
+        # return data for object
         self.Session.flush()
         return self._get(obj)