From e6ce2dff3ed7ff0f1fc45a49fcfb26d38b0a2333 Mon Sep 17 00:00:00 2001
From: Daniel Subiabre <daniel.subiabre@platoniq.net>
Date: Thu, 16 Jul 2026 16:36:02 +0200
Subject: [PATCH] feat: allow project edits only on selected statuses

---
 src/Security/Voter/ProjectVoter.php | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/src/Security/Voter/ProjectVoter.php b/src/Security/Voter/ProjectVoter.php
index 3aaa5d6..16c7a23 100644
--- a/src/Security/Voter/ProjectVoter.php
+++ b/src/Security/Voter/ProjectVoter.php
@@ -3,6 +3,7 @@
 namespace App\Security\Voter;
 
 use App\ApiResource\Project\ProjectApiResource;
+use App\Entity\Project\ProjectStatus;
 use App\Entity\User\User;
 use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
 use Symfony\Component\Security\Core\Authorization\Voter\Voter;
@@ -47,6 +48,15 @@ final class ProjectVoter extends Voter
             return true;
         }
 
-        return $this->isOwnerOf($project, $user);
+        if (!$this->isOwnerOf($project, $user)) {
+            return false;
+        }
+
+        return in_array($project->status, [
+            ProjectStatus::InDraft,
+            ProjectStatus::InCampaignReviewToChange,
+            ProjectStatus::ToCampaign,
+            ProjectStatus::InCampaign,
+        ]);
     }
 }