fix(responses): reject stale scheduling answers

tests/test_service.py

@@ -44,6 +44,7 @@ from govoplan_scheduling.backend.router import (
     api_create_tentative_calendar_holds,
     api_decide_scheduling_request,
     api_evaluate_calendar_freebusy,
+    api_get_my_scheduling_availability,
     api_get_scheduling_request,
     api_list_scheduling_requests,
     api_scheduling_summary,
@@ -66,6 +67,7 @@ from govoplan_scheduling.backend.service import (
     open_scheduling_request,
     require_visible_scheduling_results,
     scheduling_request_summary,
+    scheduling_slot_revision,
     update_scheduling_request,
 )
 from govoplan_scheduling.backend.runtime import configure_runtime
@@ -825,7 +827,12 @@ class SchedulingServiceTests(unittest.TestCase):
             "attacker",
             email="alice@example.test",
             membership_id="alice-membership",
-            scopes={SCHEDULING_READ_SCOPE, "poll:poll:read", "poll:response:write"},
+            scopes={
+                SCHEDULING_READ_SCOPE,
+                SCHEDULING_RESPOND_SCOPE,
+                "poll:poll:read",
+                "poll:response:write",
+            },
         )
 
         response = api_submit_poll_response(
@@ -842,9 +849,19 @@ class SchedulingServiceTests(unittest.TestCase):
             session=self.session,
             principal=attacker,
         )
+        current = api_get_my_scheduling_availability(
+            request.id,
+            session=self.session,
+            principal=attacker,
+        )
 
         self.assertNotIn("invitation_id", response.metadata)
         self.assertEqual([request.id], [item.id for item in listed.requests])
+        self.assertTrue(current.has_response)
+        self.assertEqual(
+            [(answer.slot_id, answer.value) for answer in current.answers],
+            [(request.slots[0].id, "available")],
+        )
         alice = next(participant for participant in request.participants if participant.display_name == "Alice")
         bob = next(participant for participant in request.participants if participant.display_name == "Bob")
         self.assertEqual(alice.status, "responded")
@@ -883,10 +900,12 @@ class SchedulingServiceTests(unittest.TestCase):
                     SchedulingAvailabilityAnswerInput(
                         slot_id=request.slots[0].id,
                         value="available",
+                        option_revision=scheduling_slot_revision(request.slots[0]),
                     ),
                     SchedulingAvailabilityAnswerInput(
                         slot_id=request.slots[1].id,
                         value="maybe",
+                        option_revision=scheduling_slot_revision(request.slots[1]),
                     ),
                 ]
             ),
@@ -917,6 +936,7 @@ class SchedulingServiceTests(unittest.TestCase):
                         SchedulingAvailabilityAnswerInput(
                             slot_id=request.slots[0].id,
                             value="unavailable",
+                            option_revision=scheduling_slot_revision(request.slots[0]),
                         )
                     ]
                 ),
@@ -969,10 +989,12 @@ class SchedulingServiceTests(unittest.TestCase):
                     SchedulingAvailabilityAnswerInput(
                         slot_id=request.slots[0].id,
                         value="unavailable",
+                        option_revision=scheduling_slot_revision(request.slots[0]),
                     ),
                     SchedulingAvailabilityAnswerInput(
                         slot_id=request.slots[1].id,
                         value="maybe",
+                        option_revision=scheduling_slot_revision(request.slots[1]),
                     ),
                 ]
             ),