empêcher de mettre à jour le motif d’un RDV

betagouv · Jan 30, 2025 · 64b68e4 · 64b68e4
1 parent 9f682a5
commit 64b68e4
Show file tree

Hide file tree

Showing 2 changed files with 17 additions and 1 deletion.
diff --git a/app/controllers/admin/rdvs_controller.rb b/app/controllers/admin/rdvs_controller.rb
@@ -164,7 +164,7 @@ def set_rdv
   end
 
   def rdv_update_params
-    allowed_params = params.require(:rdv).permit(:motif_id, :status, :lieu_id, :duration_in_min, :starts_at, :context, :ignore_benign_errors, :max_participants_count, :name,
+    allowed_params = params.require(:rdv).permit(:status, :lieu_id, :duration_in_min, :starts_at, :context, :ignore_benign_errors, :max_participants_count, :name,
                                                  participations_attributes: %i[user_id send_lifecycle_notifications send_reminder_notification id _destroy],
                                                  lieu_attributes: %i[name address latitude longitude id])
 

diff --git a/spec/features/agents/agent_can_update_rdv_spec.rb b/spec/features/agents/agent_can_update_rdv_spec.rb
@@ -54,4 +54,20 @@
       end
     end
   end
+
+  context "mise à jour vers un motif d’une autre organisation", js: true do
+    let!(:other_motif) { create(:motif, name: "Dȋner aux chandelles", organisation: create(:organisation)) }
+
+    it "empêche" do
+      visit edit_admin_organisation_rdv_path(organisation, rdv)
+      js = <<~JS
+        var selectElt = document.querySelector('select#rdv_motif_id');
+        selectElt.options[selectElt.selectedIndex].value = "#{other_motif.id}";
+        selectElt.removeAttribute('disabled');
+      JS
+      page.execute_script(js)
+      click_button "Enregistrer"
+      expect(page).not_to have_content("Dȋner aux chandelles")
+    end
+  end
 end