Do not allow client to change server set statuses

app/models/epp/epp_domain.rb

@@ -125,7 +125,7 @@ class Epp::EppDomain < Domain
 
   def attach_statuses(status_list)
     status_list.each do |x|
-      unless DomainStatus::STATUSES.include?(x[:value])
+      unless DomainStatus::CLIENT_STATUSES.include?(x[:value])
         add_epp_error('2303', 'status', x[:value], [:domain_statuses, :not_found])
         next
       end
@@ -169,6 +169,11 @@ class Epp::EppDomain < Domain
   def detach_statuses(status_list)
     to_delete = []
     status_list.each do |x|
+      unless DomainStatus::CLIENT_STATUSES.include?(x[:value])
+        add_epp_error('2303', 'status', x[:value], [:domain_statuses, :not_found])
+        next
+      end
+
       status = domain_statuses.find_by(value: x[:value])
       if status.blank?
         add_epp_error('2303', 'status', x[:value], [:domain_statuses, :not_found])

spec/epp/domain_spec.rb

@@ -1062,6 +1062,25 @@ describe 'EPP Domain', epp: true do
         expect(response[:results][2][:value]).to eq('clientHold')
       end
 
+      it 'does not remove server statuses' do
+        d = Domain.last
+        d.domain_statuses.create(value: DomainStatus::SERVER_HOLD)
+
+        xml = domain_update_xml({
+          rem: [
+            _anonymus: [
+              { status: { value: '', attrs: { s: 'serverHold' } } }
+            ]
+          ]
+        })
+
+        response = epp_request(xml, :xml)
+
+        expect(response[:results][0][:result_code]).to eq('2303')
+        expect(response[:results][0][:msg]).to eq('Status was not found')
+        expect(response[:results][0][:value]).to eq('serverHold')
+      end
+
       it 'does not add duplicate objects to domain' do
         Fabricate(:contact, code: 'mak21')
 

spec/fabricators/epp_domain_fabricator.rb

@@ -0,0 +1 @@
+Fabricator(:epp_domain, from: :domain, class_name: 'Epp::EppDomain')

spec/models/epp_domain_spec.rb

@@ -0,0 +1,94 @@
+require 'rails_helper'
+
+describe Epp::EppDomain do
+  context 'with sufficient settings' do
+    let(:domain) { Fabricate(:epp_domain) }
+
+    before(:each) do
+      create_settings
+    end
+
+    it 'attaches valid statuses' do
+      domain.attach_statuses([
+        {
+          value: DomainStatus::CLIENT_HOLD,
+          description: 'payment overdue'
+        },
+        {
+          value: DomainStatus::CLIENT_DELETE_PROHIBITED
+        }
+      ])
+
+      domain.save
+      domain.reload
+
+      expect(domain.domain_statuses.first.value).to eq(DomainStatus::CLIENT_HOLD)
+      expect(domain.domain_statuses.first.description).to eq('payment overdue')
+
+      expect(domain.domain_statuses.last.value).to eq(DomainStatus::CLIENT_DELETE_PROHIBITED)
+    end
+
+    it 'adds an epp error when invalid statuses are attached' do
+      domain.attach_statuses([
+        {
+          value: DomainStatus::SERVER_HOLD,
+          description: 'payment overdue'
+        },
+        {
+          value: DomainStatus::CLIENT_DELETE_PROHIBITED
+        }
+      ])
+
+      expect(domain.errors[:epp_errors].length).to eq(1)
+
+      err = domain.errors[:epp_errors].first
+
+      expect(err[:msg]).to eq('Status was not found')
+      expect(err[:value][:val]).to eq(DomainStatus::SERVER_HOLD)
+    end
+
+    it 'detaches valid statuses' do
+      domain.attach_statuses([
+        {
+          value: DomainStatus::CLIENT_HOLD,
+          description: 'payment overdue'
+        },
+        {
+          value: DomainStatus::CLIENT_DELETE_PROHIBITED
+        }
+      ])
+
+      domain.save
+
+      domain.detach_statuses([
+        {
+          value: DomainStatus::CLIENT_HOLD
+        }
+      ])
+
+      domain.save
+      domain.reload
+
+      expect(domain.domain_statuses.count).to eq(1)
+
+      expect(domain.domain_statuses.first.value).to eq(DomainStatus::CLIENT_DELETE_PROHIBITED)
+    end
+
+    it 'adds an epp error when invalid statuses are detached' do
+      domain.domain_statuses.create(value: DomainStatus::SERVER_HOLD)
+
+      domain.detach_statuses([
+        {
+          value: DomainStatus::SERVER_HOLD
+        }
+      ])
+
+      expect(domain.errors[:epp_errors].length).to eq(1)
+
+      err = domain.errors[:epp_errors].first
+
+      expect(err[:msg]).to eq('Status was not found')
+      expect(err[:value][:val]).to eq(DomainStatus::SERVER_HOLD)
+    end
+  end
+end