Don’t allow publishing new versions of an archived gem

app/models/pusher.rb

@@ -18,7 +18,7 @@ def initialize(api_key, body, request: nil)
 
   def process
     trace("gemcutter.pusher.process", tags: { "gemcutter.api_key.owner" => owner.to_gid }) do
-      pull_spec && find && authorize && verify_gem_scope && verify_mfa_requirement && validate && save
+      pull_spec && find && authorize && verify_gem_scope && verify_not_archived && verify_mfa_requirement && validate && save
     end
   end
 
@@ -32,6 +32,12 @@ def verify_gem_scope
     notify("This API key cannot perform the specified action on this gem.", 403)
   end
 
+  def verify_not_archived
+    return true unless rubygem.archived?
+
+    notify("This gem has been archived, and is in a read-only state.", 401)
+  end
+
   def verify_mfa_requirement
     (!api_key.user? || owner.mfa_enabled?) || !(version_mfa_required? || rubygem.metadata_mfa_required?) ||
       notify("Rubygem requires owners to enable MFA. You must enable MFA before pushing new version.", 403)

test/factories/rubygem.rb

@@ -8,6 +8,12 @@
 
     name
 
+    trait :archived do
+      archived_at { Time.current }
+      archived { true }
+      archived_by { 1 }
+    end
+
     after(:build) do |rubygem, evaluator|
       if evaluator.linkset
         rubygem.linkset = evaluator.linkset

test/models/pusher_test.rb

@@ -47,6 +47,7 @@ class PusherTest < ActiveSupport::TestCase
         @cutter.stubs(:authorize).returns true
         @cutter.stubs(:verify_mfa_requirement).returns true
         @cutter.stubs(:verify_gem_scope).returns true
+        @cutter.stubs(:verify_not_archived).returns true
         @cutter.stubs(:validate).returns true
         @cutter.stubs(:save)
 
@@ -104,6 +105,7 @@ class PusherTest < ActiveSupport::TestCase
         @cutter.stubs(:authorize).returns true
         @cutter.stubs(:verify_gem_scope).returns true
         @cutter.stubs(:verify_mfa_requirement).returns false
+        @cutter.stubs(:verify_not_archived).returns true
         @cutter.stubs(:validate).never
         @cutter.stubs(:save).never
 
@@ -116,6 +118,7 @@ class PusherTest < ActiveSupport::TestCase
         @cutter.stubs(:authorize).returns true
         @cutter.stubs(:verify_gem_scope).returns true
         @cutter.stubs(:verify_mfa_requirement).returns true
+        @cutter.stubs(:verify_not_archived).returns true
         @cutter.stubs(:validate).returns false
         @cutter.stubs(:save).never
 
@@ -844,4 +847,21 @@ def two_cert_chain(signing_key:, root_not_before: Time.current, cert_not_before:
       RubygemFs.mock!
     end
   end
+
+  context "the gem has been archived" do
+    setup do
+      @rubygem = create(:rubygem, :archived, name: "test")
+
+      Gem::Specification.any_instance.stubs(:authors).returns(["[email protected]"])
+
+      @gem = gem_file("test-1.0.0.gem")
+      @cutter = Pusher.new(@api_key, @gem)
+    end
+
+    should "not not process the gem" do
+      refute @cutter.process
+      assert_equal "This gem has been archived, and is in a read-only state.", @cutter.message
+      assert_equal 401, @cutter.code
+    end
+  end
 end