Add is_locked field on the Product model #310 (#311)

* Add is_locked field on the Product model #310

Signed-off-by: tdruez <tdruez@nexb.com>

* Add is_locked indication in the UI #310

Also, remove edit permissions when Product is_locked

Signed-off-by: tdruez <tdruez@nexb.com>

* Refine the warning message UI and disable actions buttons #310

Signed-off-by: tdruez <tdruez@nexb.com>

* Move the is_locked field on the ProductStatus model #310

Signed-off-by: tdruez <tdruez@nexb.com>

* Add unit tests and changelog entry #310

Signed-off-by: tdruez <tdruez@nexb.com>

---------

Signed-off-by: tdruez <tdruez@nexb.com>

Author: tdruez

CHANGELOG.rst

@@ -1,6 +1,12 @@
 Release notes
 =============
 
+### Version 5.3.1-dev (unreleased)
+
+- Add new `is_locked` "Locked inventory" field to the ProductStatus model.
+  When a Product is locked through his status, its inventory cannot be modified.
+  https://github.com/aboutcode-org/dejacode/issues/189
+
 ### Version 5.3.0
 
 - Rename ProductDependency is_resolved to is_pinned.

component_catalog/forms.py

@@ -624,8 +624,11 @@ def __init__(self, user, *args, **kwargs):
         super().__init__(user, *args, **kwargs)
 
         product_field = self.fields["product"]
-        perms = ["view_product", "change_product"]
-        product_field.queryset = Product.objects.get_queryset(user, perms=perms)
+        product_field.queryset = Product.objects.get_queryset(
+            user=user,
+            perms=["view_product", "change_product"],
+            exclude_locked=True,
+        )
 
         if relation_instance:
             help_text = f'"{relation_instance}" will be assigned to the selected product.'
@@ -709,7 +712,9 @@ def __init__(self, request, model, relation_model, *args, **kwargs):
         self.relation_model = relation_model
         self.dataspace = request.user.dataspace
         self.fields["product"].queryset = Product.objects.get_queryset(
-            request.user, perms=["view_product", "change_product"]
+            user=request.user,
+            perms=["view_product", "change_product"],
+            exclude_locked=True,
         )
 
     def get_selected_objects(self):

dejacode/__init__.py

@@ -14,7 +14,7 @@
 
 import git
 
-VERSION = "5.3.0"
+VERSION = "5.3.1-dev"
 
 PROJECT_DIR = Path(__file__).resolve().parent
 ROOT_DIR = PROJECT_DIR.parent

dejacode/static/css/dejacode_bootstrap.css

@@ -368,7 +368,7 @@ table.packages-table .column-primary_language {
   width: 130px;
 }
 .list-inline-margin-sm .list-inline-item:not(:last-child) {
-  margin-right: 0.3rem;
+  margin-right: 0.125rem;
 }
 
 /* -- Vulnerability List -- */

dje/templates/object_details_base.html

@@ -22,7 +22,7 @@
           <h1 class="header-title text-break">
             {% block header_title %}
               {{ object|truncatechars:100 }}
-              <small class="ms-1" style="font-size: 70%">
+              <small class="ms-1" style="font-size: 65%">
                 {% if is_user_dataspace %}
                   {% if has_change_permission %}
                     {% with object.get_change_url as object_change_url %}

dje/tests/testfiles/test_dataset_pp_only.json

@@ -61,7 +61,8 @@
     "default_on_addition": false,
     "label": "Approved",
     "text": "Approved",
-    "request_to_generate": null
+    "request_to_generate": null,
+    "is_locked": false
   }
 },
 {

product_portfolio/admin.py

@@ -88,6 +88,7 @@ class ProductStatusAdmin(BaseStatusAdmin):
         "label",
         "text",
         "default_on_addition",
+        "is_locked",
         "request_to_generate",
         "get_dataspace",
     )
@@ -99,6 +100,7 @@ class ProductStatusAdmin(BaseStatusAdmin):
                     "label",
                     "text",
                     "default_on_addition",
+                    "is_locked",
                     "request_to_generate",
                     "dataspace",
                     "uuid",

product_portfolio/forms.py

@@ -249,6 +249,7 @@ class Meta:
             "homepage_url",
             "primary_language",
             "admin_notes",
+            "is_active",
             "configuration_status",
             "contact",
             "vcs_url",

product_portfolio/migrations/0013_productstatus_is_locked_and_more.py

@@ -0,0 +1,30 @@
+# Generated by Django 5.1.9 on 2025-05-30 14:30
+
+import django.db.models.deletion
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('component_catalog', '0011_alter_component_owner'),
+        ('product_portfolio', '0012_alter_scancodeproject_status_and_more'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='productstatus',
+            name='is_locked',
+            field=models.BooleanField(db_index=True, default=False, help_text='Marks this product version as read-only, preventing any modifications to its inventory.', verbose_name='Locked inventory'),
+        ),
+        migrations.AlterField(
+            model_name='productdependency',
+            name='for_package',
+            field=models.ForeignKey(blank=True, help_text='The package that declares this dependency.', null=True, on_delete=django.db.models.deletion.CASCADE, related_name='declared_dependencies', to='component_catalog.package'),
+        ),
+        migrations.AlterField(
+            model_name='productdependency',
+            name='resolved_to_package',
+            field=models.ForeignKey(blank=True, help_text='The resolved package for this dependency. If empty, it indicates the dependency is unresolved.', null=True, on_delete=django.db.models.deletion.SET_NULL, related_name='resolved_from_dependencies', to='component_catalog.package'),
+        ),
+    ]

product_portfolio/models.py

@@ -115,6 +115,15 @@ class ProductStatus(BaseStatusMixin, DataspacedModel):
             "fields, since DejaCode will be creating the Request automatically."
         ),
     )
+    is_locked = models.BooleanField(
+        verbose_name=_("Locked inventory"),
+        default=False,
+        db_index=True,
+        help_text=_(
+            "Marks this product version as read-only, preventing any modifications to "
+            "its inventory."
+        ),
+    )
 
     class Meta(BaseStatusMixin.Meta):
         verbose_name_plural = _("product status")
@@ -141,7 +150,9 @@ def get_by_natural_key(self, dataspace_name, uuid):
         """
         return self.model.unsecured_objects.get(dataspace__name=dataspace_name, uuid=uuid)
 
-    def get_queryset(self, user=None, perms="view_product", include_inactive=False):
+    def get_queryset(
+        self, user=None, perms="view_product", include_inactive=False, exclude_locked=False
+    ):
         """
         Force the object level protection at the QuerySet level.
         Always Return an empty QuerySet unless a `user` is provided.
@@ -162,6 +173,9 @@ def get_queryset(self, user=None, perms="view_product", include_inactive=False):
             user, perms, klass=queryset_class, accept_global_perms=False
         ).scope(user.dataspace)
 
+        if exclude_locked:
+            queryset = queryset.exclude(configuration_status__is_locked=True)
+
         if include_inactive:
             return queryset
 
@@ -350,6 +364,12 @@ def actions_on_status_change(self):
                 object_id=self.id,
             )
 
+    @cached_property
+    def is_locked(self):
+        if self.configuration_status_id:
+            return self.configuration_status.is_locked
+        return False
+
     @cached_property
     def all_packages(self):
         return Package.objects.filter(