fix(events): refuse submit and withdraw after winner selection and track updated_at

contracts/events/src/event_ops.rs

@@ -539,6 +539,11 @@ pub fn submit(
     if !matches!(event.status, EventStatus::Active) {
         return Err(Error::EventNotActive);
     }
+    if storage::winner_count(env, event_id) > 0
+        || storage::get_prize_claim_expiry(env, event_id).is_some()
+    {
+        return Err(Error::WinnersAlreadySelected);
+    }
     if matches!(event.pillar, Pillar::Crowdfunding) {
         return Err(Error::InvalidPillar);
     }
@@ -567,15 +572,17 @@ pub fn submit(
     // cannot lock real participants out of a full event.
     storage::append_submission(env, event_id, &applicant)?;
 
+    let now = env.ledger().timestamp();
     let submitted_at = existing
         .as_ref()
         .map(|s| s.submitted_at)
-        .unwrap_or_else(|| env.ledger().timestamp());
+        .unwrap_or(now);
 
     let submission = Submission {
         applicant: applicant.clone(),
         content_uri: content_uri.clone(),
         submitted_at,
+        updated_at: now,
     };
     storage::set_submission(env, event_id, &applicant, &submission);
 
@@ -605,6 +612,11 @@ pub fn withdraw_submission(
     if !matches!(event.status, EventStatus::Active) {
         return Err(Error::EventNotActive);
     }
+    if storage::winner_count(env, event_id) > 0
+        || storage::get_prize_claim_expiry(env, event_id).is_some()
+    {
+        return Err(Error::WinnersAlreadySelected);
+    }
 
     applicant.require_auth();
     idempotency::require_unseen(env, &applicant, &op_id)?;

contracts/events/src/tests/hackathon_pillar.rs

@@ -199,15 +199,44 @@ fn resubmit_keeps_original_timestamp_and_updates_uri() {
     let uri_a = String::from_str(&ctx.env, "ipfs://Qm.../v1.json");
     let op_a = BytesN::random(&ctx.env);
     ctx.events.submit(&id, &ctx.applicant, &uri_a, &op_a);
-    let first_time = ctx.events.get_submission(&id, &ctx.applicant).submitted_at;
+    let first = ctx.events.get_submission(&id, &ctx.applicant);
+    assert_eq!(first.submitted_at, ctx.env.ledger().timestamp());
+    assert_eq!(first.updated_at, ctx.env.ledger().timestamp());
 
     let uri_b = String::from_str(&ctx.env, "ipfs://Qm.../v2.json");
     let op_b = BytesN::random(&ctx.env);
     ctx.events.submit(&id, &ctx.applicant, &uri_b, &op_b);
 
     let second = ctx.events.get_submission(&id, &ctx.applicant);
     assert_eq!(second.content_uri, uri_b);
-    assert_eq!(second.submitted_at, first_time);
+    assert_eq!(second.submitted_at, first.submitted_at);
+    assert_eq!(second.updated_at, ctx.env.ledger().timestamp());
+}
+
+#[test]
+fn submit_and_withdraw_after_selection_rejected() {
+    let ctx = setup();
+    let id = create_hackathon(&ctx);
+
+    let uri = String::from_str(&ctx.env, "ipfs://Qm.../v1.json");
+    let op = BytesN::random(&ctx.env);
+    ctx.events.submit(&id, &ctx.applicant, &uri, &op);
+
+    let winners = soroban_sdk::vec![
+        &ctx.env,
+        WinnerSpec {
+            recipient: ctx.applicant.clone(),
+            position: 1,
+            reputation_bump: 0,
+        },
+    ];
+    ctx.events.select_winners(&id, &winners, &BytesN::random(&ctx.env));
+
+    let res = ctx.events.try_submit(&id, &ctx.applicant, &uri, &BytesN::random(&ctx.env));
+    assert_eq!(res, Err(Ok(Error::WinnersAlreadySelected)));
+
+    let res_w = ctx.events.try_withdraw_submission(&id, &ctx.applicant, &BytesN::random(&ctx.env));
+    assert_eq!(res_w, Err(Ok(Error::WinnersAlreadySelected)));
 }
 
 #[test]

contracts/events/src/types.rs

@@ -105,6 +105,7 @@ pub struct Submission {
     pub applicant: Address,
     pub content_uri: String,
     pub submitted_at: u64,
+    pub updated_at: u64,
 }
 
 // ============================================================