feat(products): gate structural catalog edits on attachment

## Context

Once a catalog entity is part of a plan or subscription, its structural
fields must stop changing: the code, an item's product attachment, and a
filter's values. Cosmetic fields (name, description, invoice display name)
stay editable.

## Description

In the update services, assign code (products, items, filters), product
attachment (items) and values (filters) only while the entity is not
attached to a plan or subscription, silently skipping them otherwise.
Expose those attributes on the update inputs and add an
attached_to_plan_or_subscription field on the GraphQL types so the UI knows
when to lock them.

Author: rsempe

app/graphql/types/product_item_filters/object.rb

@@ -11,6 +11,7 @@ class Object < Types::BaseObject
       field :id, ID, null: false
       field :organization, Types::Organizations::OrganizationType
 
+      field :attached_to_plan_or_subscription, Boolean, null: false, method: :attached_to_plan_or_subscription?
       field :code, String, null: false
       field :description, String, null: true
       field :invoice_display_name, String, null: true

app/graphql/types/product_item_filters/update_input.rb

@@ -7,6 +7,7 @@ class UpdateInput < BaseInputObject
 
       argument :id, ID, required: true
 
+      argument :code, String, required: false
       argument :description, String, required: false
       argument :invoice_display_name, String, required: false
       argument :name, String, required: false

app/graphql/types/product_items/object.rb

@@ -11,6 +11,7 @@ class Object < Types::BaseObject
       field :id, ID, null: false
       field :organization, Types::Organizations::OrganizationType
 
+      field :attached_to_plan_or_subscription, Boolean, null: false, method: :attached_to_plan_or_subscription?
       field :code, String, null: false
       field :description, String, null: true
       field :invoice_display_name, String, null: true

app/graphql/types/product_items/update_input.rb

@@ -7,9 +7,11 @@ class UpdateInput < BaseInputObject
 
       argument :id, ID, required: true
 
+      argument :code, String, required: false
       argument :description, String, required: false
       argument :invoice_display_name, String, required: false
       argument :name, String, required: false
+      argument :product_id, ID, required: false
     end
   end
 end

app/graphql/types/products/object.rb

@@ -14,6 +14,7 @@ class Object < Types::BaseObject
       field :invoice_display_name, String, null: true
       field :name, String, null: false
 
+      field :attached_to_plan_or_subscription, Boolean, null: false, method: :attached_to_plan_or_subscription?
       field :product_items_count, Integer, null: false
 
       field :created_at, GraphQL::Types::ISO8601DateTime, null: false

app/graphql/types/products/update_input.rb

@@ -7,6 +7,7 @@ class UpdateInput < BaseInputObject
 
       argument :id, ID, required: true
 
+      argument :code, String, required: false
       argument :description, String, required: false
       argument :invoice_display_name, String, required: false
       argument :name, String, required: false

app/services/product_item_filters/update_service.rb

@@ -18,7 +18,11 @@ def initialize(product_item_filter:, params:)
     def call
       return result.not_found_failure!(resource: "product_item_filter") unless product_item_filter
 
-      if params.key?(:values)
+      # NOTE: code and values can only be edited while the filter's item is not
+      #       yet in a plan or subscription
+      editable = !product_item_filter.attached_to_plan_or_subscription?
+
+      if editable && params.key?(:values)
         values_validation = ProductItemFilters::ValidateValuesService.call(
           product_item: product_item_filter.product_item,
           values_params: params[:values],
@@ -31,9 +35,10 @@ def call
         product_item_filter.name = params[:name] if params.key?(:name)
         product_item_filter.description = params[:description] if params.key?(:description)
         product_item_filter.invoice_display_name = params[:invoice_display_name] if params.key?(:invoice_display_name)
+        product_item_filter.code = params[:code] if editable && params.key?(:code)
         product_item_filter.save!
 
-        replace_values if params.key?(:values)
+        replace_values if editable && params.key?(:values)
 
         result.product_item_filter = product_item_filter
       end

app/services/product_items/update_service.rb

@@ -21,6 +21,16 @@ def call
       product_item.name = params[:name] if params.key?(:name)
       product_item.description = params[:description] if params.key?(:description)
       product_item.invoice_display_name = params[:invoice_display_name] if params.key?(:invoice_display_name)
+
+      # NOTE: code and product attachment can only be edited while the item is
+      #       not yet in a plan or subscription
+      unless product_item.attached_to_plan_or_subscription?
+        product_item.code = params[:code] if params.key?(:code)
+        assign_product if params.key?(:product_id)
+      end
+
+      return result if result.failure?
+
       product_item.save!
 
       result.product_item = product_item
@@ -32,5 +42,17 @@ def call
     private
 
     attr_reader :product_item, :params
+
+    def assign_product
+      if params[:product_id].blank?
+        product_item.product = nil
+        return
+      end
+
+      product = product_item.organization.products.find_by(id: params[:product_id])
+      return result.not_found_failure!(resource: "product") unless product
+
+      product_item.product = product
+    end
   end
 end

app/services/products/update_service.rb

@@ -21,6 +21,10 @@ def call
       product.name = params[:name] if params.key?(:name)
       product.description = params[:description] if params.key?(:description)
       product.invoice_display_name = params[:invoice_display_name] if params.key?(:invoice_display_name)
+
+      # NOTE: code can only be edited while the product is not yet in a plan or subscription
+      product.code = params[:code] if params.key?(:code) && !product.attached_to_plan_or_subscription?
+
       product.save!
 
       result.product = product