Require attribute edit permission for API writes

Issue#editable? is attributes_editable? || notes_addable?, so the API
let note-only users rewrite dates and times. Gate PUT/DELETE on
attributes_editable? instead, with a regression test that pins the
note-only scenario (#16).

While here, restructure the update action: the symbol-table loop with
send is replaced by an explicit per-side helper (#20).

Author: dkastl

app/controllers/issue_datetimes_controller.rb

@@ -12,24 +12,10 @@ def show
   # A timestamp sets both the core date and the time of day; null clears
   # the time of day and keeps the date. Omitted keys are left untouched.
   def update
-    zone = RedmineIssueDatetime.reference_zone
     @issue.init_journal(User.current)
 
-    [[:starts_at, :start_date, :start_time=], [:ends_at, :due_date, :due_time=]].each do |param, date_attr, time_writer|
-      next unless params.key?(param)
-
-      value = params[param]
-      if value.present?
-        timestamp = parse_timestamp(value)
-        return render_parse_error(param) if timestamp.nil?
-
-        local = timestamp.in_time_zone(zone)
-        @issue.send(:"#{date_attr}=", local.to_date)
-        @issue.send(time_writer, local.strftime('%H:%M'))
-      else
-        @issue.send(time_writer, '')
-      end
-    end
+    return unless apply_time_param(:starts_at, :start_date=, :start_time=)
+    return unless apply_time_param(:ends_at, :due_date=, :due_time=)
 
     if @issue.save
       render json: issue_payload(@issue.reload)
@@ -81,8 +67,11 @@ def find_issue
     render_404
   end
 
+  # attributes_editable?, not editable?: this endpoint changes issue
+  # attributes (dates and times). editable? is also true for users who may
+  # only add notes, and those must not be able to change dates here.
   def require_edit_permission
-    return render_403 unless @issue.editable?
+    return render_403 unless @issue.attributes_editable?
   end
 
   def find_project
@@ -91,6 +80,30 @@ def find_project
     render_404
   end
 
+  # Applies one side (start or due) of the request payload to the issue.
+  # Returns false when the value could not be parsed; the error response
+  # has been rendered in that case and the caller must stop.
+  def apply_time_param(param, date_writer, time_writer)
+    return true unless params.key?(param)
+
+    value = params[param]
+    if value.blank?
+      @issue.public_send(time_writer, '')
+      return true
+    end
+
+    timestamp = parse_timestamp(value)
+    if timestamp.nil?
+      render_parse_error(param)
+      return false
+    end
+
+    local = timestamp.in_time_zone(RedmineIssueDatetime.reference_zone)
+    @issue.public_send(date_writer, local.to_date)
+    @issue.public_send(time_writer, local.strftime('%H:%M'))
+    true
+  end
+
   # Requires an explicit offset (Z or +hh:mm) so API writes are
   # unambiguous regardless of the server's local time zone.
   def parse_timestamp(value)

test/integration/issue_datetimes_api_test.rb

@@ -87,6 +87,24 @@ def setup
     assert_equal [@issue.id], rows.map { |r| r['issue_id'] }
   end
 
+  # editable? is also true for users who may only add notes; writing dates
+  # and times is attribute editing and must require attributes_editable?.
+  test 'a user who can only add notes cannot change times' do
+    role = Role.find(1)
+    role.remove_permission!(:edit_issues, :edit_own_issues)
+    role.add_permission!(:add_notes)
+    user = User.find(2)
+    assert @issue.editable?(user), 'setup: the user should still pass editable?'
+    assert_not @issue.attributes_editable?(user)
+
+    put "/issues/#{@issue.id}/datetime.json",
+        params: {starts_at: '2026-08-03T09:15:00Z'}.to_json,
+        headers: {'Content-Type' => 'application/json'}.merge(credentials('jsmith'))
+
+    assert_response :forbidden
+    assert_nil @issue.reload.issue_datetime
+  end
+
   test 'anonymous users cannot write when login is required' do
     with_settings login_required: '1' do
       put "/issues/#{@issue.id}/datetime.json",