From b1063d5332445613f3f9d1cd705d077f5c8f351c Mon Sep 17 00:00:00 2001
From: Sudhir Nimavat <sudhir@nimavat.me>
Date: Thu, 19 Jun 2025 12:49:09 +0530
Subject: [PATCH] Disable create/update/upsert/bulk ops on Syncjob endpoint

---
 .../yakworks/rest/SyncjobRestApiSpec.groovy   | 29 ++++++++++++++++
 .../yakworks/rally/job/SyncJobCrudApi.groovy  | 33 +++++++++++++++++++
 2 files changed, 62 insertions(+)

diff --git a/examples/rally-api/src/integration-test/groovy/yakworks/rest/SyncjobRestApiSpec.groovy b/examples/rally-api/src/integration-test/groovy/yakworks/rest/SyncjobRestApiSpec.groovy
index fa266e2f5..5625a34e6 100644
--- a/examples/rally-api/src/integration-test/groovy/yakworks/rest/SyncjobRestApiSpec.groovy
+++ b/examples/rally-api/src/integration-test/groovy/yakworks/rest/SyncjobRestApiSpec.groovy
@@ -41,6 +41,35 @@ class SyncjobRestApiSpec extends Specification implements OkHttpRestTrait {
         if(body && body.id) removeJob(body.id as Long)
     }
 
+    void "ops not supported"() {
+        when:
+        def resp = post(endpoint, [sourceId:"123"])
+        def custBody = bodyToMap(resp)
+
+        then: "Verify cust tags created"
+        resp.code() == 403
+        custBody
+        custBody.detail.contains "Syncjob does not support operation 'create'"
+
+        when:
+        resp = put(endpoint + "/1", [sourceId:"123"])
+        custBody = bodyToMap(resp)
+
+        then: "Verify cust tags created"
+        resp.code() == 403
+        custBody
+        custBody.detail.contains "Syncjob does not support operation 'update'"
+
+        when:
+        resp = delete(endpoint + "/1")
+        custBody = bodyToMap(resp)
+
+        then: "Verify cust tags created"
+        resp.code() == 403
+        custBody
+        custBody.detail.contains "Syncjob does not support operation 'delete'"
+    }
+
     @Transactional
     SyncJob createMockJob() {
         SyncJob job = new SyncJob([sourceType: SourceType.ERP, sourceId: 'ar/org'])
diff --git a/rally-domain/src/main/groovy/yakworks/rally/job/SyncJobCrudApi.groovy b/rally-domain/src/main/groovy/yakworks/rally/job/SyncJobCrudApi.groovy
index d97085d23..4ee2ef8ea 100644
--- a/rally-domain/src/main/groovy/yakworks/rally/job/SyncJobCrudApi.groovy
+++ b/rally-domain/src/main/groovy/yakworks/rally/job/SyncJobCrudApi.groovy
@@ -11,6 +11,11 @@ import groovy.transform.CompileStatic
 import org.springframework.stereotype.Component
 
 import gorm.tools.job.JobUtils
+import gorm.tools.job.SyncJobEntity
+import gorm.tools.repository.model.DataOp
+import yakworks.api.HttpStatus
+import yakworks.api.problem.data.DataProblem
+import yakworks.api.problem.data.DataProblemException
 import yakworks.commons.map.Maps
 import yakworks.gorm.api.DefaultCrudApi
 
@@ -25,6 +30,34 @@ class SyncJobCrudApi extends DefaultCrudApi<SyncJob> {
         super(SyncJob)
     }
 
+    CrudApiResult<SyncJob> create(Map data, Map params) {
+        throw notSupported("create")
+    }
+
+    CrudApiResult<SyncJob> update(Map data, Map params) {
+        throw notSupported("update")
+    }
+
+
+    CrudApiResult<SyncJob> upsert(Map data, Map params) {
+        throw notSupported("upsert")
+    }
+
+
+    void removeById(Serializable id, Map params) {
+        throw notSupported("delete")
+    }
+
+    @Override
+    SyncJobEntity bulk(DataOp dataOp, List<Map> dataList, Map qParams, String sourceId) {
+        throw notSupported("bulk")
+    }
+
+    private DataProblemException notSupported(String op) {
+        throw DataProblem.ex("Syncjob does not support operation '$op'").status(HttpStatus.FORBIDDEN.code)
+    }
+
+
     @Override
     Map entityToMap(SyncJob job, List<String> includes){
         //clone metamap, SomeHow trying to put a new entry in MetaMap throws UnSupportedOperationException