Stop submitted reports from having date edited.

Author: frjo

hypha/apply/projects/reports/tests/test_views.py

@@ -772,6 +772,20 @@ def test_duplicate_date_rejected(self):
         report_a.refresh_from_db()
         assert report_a.end_date == today
 
+    def test_submitted_report_cannot_be_edited(self):
+        today = timezone.now().date()
+        report = ReportFactory(
+            project__status=INVOICING_AND_REPORTING,
+            is_submitted=True,
+            end_date=today,
+        )
+        response = self.post_page(
+            report, {"end_date": (today + relativedelta(days=7)).isoformat()}
+        )
+        assert response.status_code == 404
+        report.refresh_from_db()
+        assert report.end_date == today
+
     def test_applicant_cannot_access(self):
         report = ReportFactory(project__status=INVOICING_AND_REPORTING)
         self.client.force_login(ApplicantFactory())

hypha/apply/projects/reports/views.py

@@ -14,7 +14,7 @@
 from django.contrib.auth.decorators import login_required
 from django.contrib.auth.mixins import UserPassesTestMixin
 from django.core.exceptions import PermissionDenied
-from django.http import HttpResponseRedirect
+from django.http import Http404, HttpResponseRedirect
 from django.shortcuts import get_object_or_404, redirect, render
 from django.urls import reverse
 from django.utils.decorators import method_decorator
@@ -584,6 +584,9 @@ def dispatch(self, request, *args, **kwargs):
             "update_report_config", self.request.user, self.report.project
         ):
             raise PermissionDenied(self.permission_denied_message)
+        # A submitted report's period is fixed; its due date can't be changed.
+        if self.report.current:
+            raise Http404(_("A submitted report's due date cannot be edited."))
         return super().dispatch(request, *args, **kwargs)
 
     def get(self, request, *args, **kwargs):