psa-systems/mokosh-server
Watch
9
0
Fork
You've already forked mokosh-server
 1
Code Issues Pull requests Projects Releases 10 Packages Wiki Activity Actions

feat(projects): reject task/phase create on cancelled project (PMS-399) #305

Merged
vas2000-work merged 2 commits from fix/PMS-399-reject-children-on-cancelled-project into main 2026-06-18 04:23:54 +02:00
Conversation 0 Commits 2 Files changed 2 +157
vas2000-work commented 2026-06-18 03:07:09 +02:00
Owner
Copy link

The project module's child-create endpoints did not check the parent project's status, so a task or phase could be attached to a project whose status = 'cancelled'. This adds a private ensure_project_open guard on ProjectsService that reads the project status inside the caller's tenant-scoped transaction (missing row -> 404, cancelled -> 409) and calls it at the top of create_task and create_project_phase before the INSERT, so the status check and the insert share one transaction and the RLS GUC applies to both. Scope is strictly the create/attach paths: updates to existing children and project status transitions are left alone. A DB-backed integration test covers the 409 on a cancelled project for both task and phase, asserts no child row lands, checks the 404 on a missing project, and confirms an active project still accepts both children.

#PMS-399

The project module's child-create endpoints did not check the parent project's status, so a task or phase could be attached to a project whose `status = 'cancelled'`. This adds a private `ensure_project_open` guard on `ProjectsService` that reads the project status inside the caller's tenant-scoped transaction (missing row -> 404, `cancelled` -> 409) and calls it at the top of `create_task` and `create_project_phase` before the INSERT, so the status check and the insert share one transaction and the RLS GUC applies to both. Scope is strictly the create/attach paths: updates to existing children and project status transitions are left alone. A DB-backed integration test covers the 409 on a cancelled project for both task and phase, asserts no child row lands, checks the 404 on a missing project, and confirms an active project still accepts both children. #PMS-399
vas2000-work force-pushed fix/PMS-399-reject-children-on-cancelled-project from 8deedce275
Some checks failed
Create release / Create release from merged PR (pull_request) Has been skipped
Details
Check / fmt + clippy + compile + unit/doc tests (pull_request) Failing after 6s
Details
E2E / Playwright against staging (pull_request) Successful in 32s
Details
Integration / integration tests (pull_request) Successful in 4m44s
Details
to bc71b9c578
Some checks failed
Check / fmt + clippy + compile + unit/doc tests (pull_request) Failing after 5s
Details
E2E / Playwright against staging (pull_request) Successful in 35s
Details
Integration / integration tests (pull_request) Successful in 3m50s
Details
2026-06-18 03:51:32 +02:00 Compare
style: collapse short query to one line for CI rustfmt (PMS-399)
All checks were successful
E2E / Playwright against staging (pull_request) Successful in 37s
Details
Check / fmt + clippy + compile + unit/doc tests (pull_request) Successful in 1m6s
Details
Integration / integration tests (pull_request) Successful in 8m12s
Details
Create release / Create release from merged PR (pull_request) Has been skipped
Details
224c2b7248 
CI runs a rustfmt that puts the short COUNT query on the let line; match it so cargo fmt --check passes.

#PMS-399
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
psa-systems/mokosh-server!305
No description provided.