Revert PR #14634 changes (editable=False approach)

Reverting the approach of making Engagement.product editable=False
and splitting serializers. Will replace with proper permission checks
on the destination product when moving engagements.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: Maffooch

dojo/api_v2/serializers.py

@@ -1119,7 +1119,7 @@ class Meta:
         exclude = ("inherited_tags",)
 
     def validate(self, data):
-        if data.get("target_start") and data.get("target_end"):
+        if self.context["request"].method == "POST":
             if data.get("target_start") > data.get("target_end"):
                 msg = "Your target start date exceeds your target end date"
                 raise serializers.ValidationError(msg)
@@ -1133,30 +1133,6 @@ def build_relational_field(self, field_name, relation_info):
         return super().build_relational_field(field_name, relation_info)
 
 
-class EngagementCreateSerializer(serializers.ModelSerializer):
-    product = serializers.PrimaryKeyRelatedField(
-        queryset=Product.objects.all(),
-    )
-    tags = TagListSerializerField(required=False)
-
-    class Meta:
-        model = Engagement
-        exclude = ("inherited_tags",)
-
-    def validate(self, data):
-        if data.get("target_start") > data.get("target_end"):
-            msg = "Your target start date exceeds your target end date"
-            raise serializers.ValidationError(msg)
-        return data
-
-    def build_relational_field(self, field_name, relation_info):
-        if field_name == "notes":
-            return NoteSerializer, {"many": True, "read_only": True}
-        if field_name == "files":
-            return FileSerializer, {"many": True, "read_only": True}
-        return super().build_relational_field(field_name, relation_info)
-
-
 class EngagementToNotesSerializer(serializers.Serializer):
     engagement_id = serializers.PrimaryKeyRelatedField(
         queryset=Engagement.objects.all(), many=False, allow_null=True,

dojo/api_v2/views.py

@@ -455,11 +455,6 @@ class EngagementViewSet(
     def risk_application_model_class(self):
         return Engagement
 
-    def get_serializer_class(self):
-        if self.request and self.request.method == "POST":
-            return serializers.EngagementCreateSerializer
-        return serializers.EngagementSerializer
-
     def destroy(self, request, *args, **kwargs):
         instance = self.get_object()
         if get_setting("ASYNC_OBJECT_DELETE"):

dojo/db_migrations/0264_alter_engagement_product_and_more.py

@@ -1526,7 +1526,7 @@ class Engagement(BaseModel):
     preset = models.ForeignKey(Engagement_Presets, null=True, blank=True, help_text=_("Settings and notes for performing this engagement."), on_delete=models.CASCADE)
     reason = models.CharField(max_length=2000, null=True, blank=True)
     report_type = models.ForeignKey(Report_Type, null=True, blank=True, on_delete=models.CASCADE)
-    product = models.ForeignKey(Product, editable=False, on_delete=models.CASCADE)
+    product = models.ForeignKey(Product, on_delete=models.CASCADE)
     active = models.BooleanField(default=True, editable=False)
     tracker = models.URLField(max_length=200, help_text=_("Link to epic or ticket system with changes to version."), editable=True, blank=True, null=True)
     test_strategy = models.URLField(editable=True, blank=True, null=True)