fix(api-headless-cms-scheduler): validate if entries can be updated

Author: brunozoric

packages/api-headless-cms-scheduler/src/scheduler/actions/PublishScheduleAction.ts

@@ -8,11 +8,18 @@ import {
 } from "~/scheduler/types.js";
 import { createScheduleRecord, transformScheduleEntry } from "~/scheduler/ScheduleRecord.js";
 import { convertException } from "@webiny/utils";
-import type { CmsIdentity, CmsModel, HeadlessCms } from "@webiny/api-headless-cms/types";
+import type {
+    CmsEntry,
+    CmsEntryValues,
+    CmsIdentity,
+    CmsModel,
+    HeadlessCms
+} from "@webiny/api-headless-cms/types";
 import type { ISchedulerService } from "~/service/types.js";
 import { dateToISOString } from "~/scheduler/dates.js";
 import { NotFoundError } from "@webiny/handler-graphql";
 import { dateInTheFuture } from "~/utils/dateInTheFuture.js";
+import { WebinyError } from "@webiny/error/index";
 
 export type PublishScheduleActionCms = Pick<
     HeadlessCms,
@@ -49,7 +56,8 @@ export class PublishScheduleAction implements IScheduleAction {
     public async schedule(params: IScheduleActionScheduleParams): Promise<IScheduleRecord> {
         const { targetId, input, scheduleRecordId } = params;
 
-        const targetEntry = await this.cms.getEntryById(this.targetModel, targetId);
+        const targetEntry = await this.getUpdateableTargetEntry(targetId);
+
         const title = targetEntry.values[this.targetModel.titleFieldId] || "Unknown entry title";
         const identity = this.getIdentity();
 
@@ -138,16 +146,23 @@ export class PublishScheduleAction implements IScheduleAction {
     ): Promise<IScheduleRecord> {
         const currentDate = new Date();
         const targetId = original.targetId;
+
+        const targetEntry = await this.getUpdateableTargetEntry(targetId);
+
         /**
          * There are two cases when we can immediately publish the entry:
          * 1. If the user requested it.
          * 2. If the entry is scheduled for a date in the past.
          */
         if (input.immediately || input.scheduleOn < currentDate) {
-            const updatedTargetEntry = await this.cms.updateEntry(this.targetModel, targetId, {
-                lastPublishedOn: input.dateOn ? input.dateOn.toISOString() : undefined,
-                lastPublishedBy: this.getIdentity()
-            });
+            const updatedTargetEntry = await this.cms.updateEntry(
+                this.targetModel,
+                targetEntry.id,
+                {
+                    lastPublishedOn: input.dateOn ? input.dateOn.toISOString() : undefined,
+                    lastPublishedBy: this.getIdentity()
+                }
+            );
 
             const publishedEntry = await this.cms.publishEntry(
                 this.targetModel,
@@ -227,4 +242,18 @@ export class PublishScheduleAction implements IScheduleAction {
             throw ex;
         }
     }
+
+    private async getUpdateableTargetEntry<T = CmsEntryValues>(id: string): Promise<CmsEntry<T>> {
+        const entry = await this.cms.getEntryById<T>(this.targetModel, id);
+        if (entry.locked) {
+            throw new WebinyError(
+                `Cannot schedule a publish action for entry "${entry.id}" because it is locked.`,
+                "ENTRY_LOCKED",
+                {
+                    entryId: entry.id
+                }
+            );
+        }
+        return entry;
+    }
 }

packages/api-headless-cms-scheduler/src/scheduler/actions/UnpublishScheduleAction.ts

@@ -8,11 +8,18 @@ import {
 } from "~/scheduler/types.js";
 import { createScheduleRecord, transformScheduleEntry } from "~/scheduler/ScheduleRecord.js";
 import { convertException } from "@webiny/utils";
-import type { CmsIdentity, CmsModel, HeadlessCms } from "@webiny/api-headless-cms/types";
+import type {
+    CmsEntry,
+    CmsEntryValues,
+    CmsIdentity,
+    CmsModel,
+    HeadlessCms
+} from "@webiny/api-headless-cms/types";
 import type { ISchedulerService } from "~/service/types.js";
 import { dateToISOString } from "~/scheduler/dates.js";
 import { NotFoundError } from "@webiny/handler-graphql";
 import { dateInTheFuture } from "~/utils/dateInTheFuture.js";
+import { WebinyError } from "@webiny/error";
 
 export type UnpublishScheduleActionCms = Pick<
     HeadlessCms,
@@ -49,7 +56,7 @@ export class UnpublishScheduleAction implements IScheduleAction {
     public async schedule(params: IScheduleActionScheduleParams): Promise<IScheduleRecord> {
         const { targetId, input, scheduleRecordId } = params;
 
-        const targetEntry = await this.cms.getEntryById(this.targetModel, targetId);
+        const targetEntry = await this.getUpdateableTargetEntry(targetId);
         const title = targetEntry.values[this.targetModel.titleFieldId] || "Unknown entry title";
         const identity = this.getIdentity();
 
@@ -131,13 +138,15 @@ export class UnpublishScheduleAction implements IScheduleAction {
     ): Promise<IScheduleRecord> {
         const currentDate = new Date();
         const targetId = original.targetId;
+
+        const targetEntry = await this.getUpdateableTargetEntry(targetId);
         /**
          * There are two cases when we can immediately publish the entry:
          * 1. If the user requested it.
          * 2. If the entry is scheduled for a date in the past.
          */
         if (input.immediately || dateInTheFuture(input.scheduleOn)) {
-            const publishedEntry = await this.cms.unpublishEntry(this.targetModel, targetId);
+            const publishedEntry = await this.cms.unpublishEntry(this.targetModel, targetEntry.id);
             /**
              * We can safely cancel the original schedule entry and the event.
              *
@@ -217,4 +226,18 @@ export class UnpublishScheduleAction implements IScheduleAction {
             throw ex;
         }
     }
+
+    private async getUpdateableTargetEntry<T = CmsEntryValues>(id: string): Promise<CmsEntry<T>> {
+        const entry = await this.cms.getEntryById<T>(this.targetModel, id);
+        if (entry.locked) {
+            throw new WebinyError(
+                `Cannot schedule a unpublish action for entry "${entry.id}" because it is locked.`,
+                "ENTRY_LOCKED",
+                {
+                    entryId: entry.id
+                }
+            );
+        }
+        return entry;
+    }
 }