Prevent a finalized audit from being edited

While the validation added prevented a finalized
audit to have its status changed, QA showed that
it was possible to confirm an edited audit
that has already been finalized.

With this change, we prevent any edits from being
made to a finalized audit and display a message
for the user to make the experience better.

Author: stefannibrasil

app/controllers/audits_controller.rb

@@ -36,6 +36,11 @@ def finalize
   end
 
   def update
+    if @audit.reload.finalized?
+      redirect_to audit_path(@audit), error: "This audit has been finalized and cannot be edited."
+      return
+    end
+
     @audit.line_items.destroy_all
     if @audit.update(audit_params)
       save_audit_status_and_redirect(params)

spec/requests/audits_requests_spec.rb

@@ -109,6 +109,40 @@
       end
     end
 
+    describe "PUT #update" do
+      it "confirms the updated audit and redirects to the audit" do
+        audit = create(:audit, organization: organization, status: :in_progress)
+        item = create(:item)
+        audit.line_items << create(:line_item, quantity: 3, item: item)
+
+        put audit_path(id: audit.to_param, audit: {
+          storage_location_id: storage_location.id,
+          line_items_attributes: {"0" => {"item_id" => item.id, "quantity" => "4"}}
+        })
+
+        expect(response).to redirect_to(audit_path(audit))
+        expect(flash[:notice]).to include("Audit is confirmed.")
+        expect(audit.reload).to be_confirmed
+      end
+
+      context "when the audit has already been finalized" do
+        it "does not allow updates and redirects to the finalized audit" do
+          finalized_audit = create(:audit, organization: organization, status: :finalized)
+          item = create(:item)
+          finalized_audit.line_items << create(:line_item, quantity: 3, item: item)
+
+          put audit_path(id: finalized_audit.to_param, audit: {
+            storage_location_id: storage_location.id,
+            line_items_attributes: {"0" => {"item_id" => item.id, "quantity" => "4"}}
+          })
+
+          expect(response).to redirect_to(audit_path(finalized_audit))
+          expect(flash[:error]).to include("This audit has been finalized and cannot be edited.")
+          expect(finalized_audit.line_items.first.quantity).to eq(3)
+        end
+      end
+    end
+
     describe "POST #create" do
       context "with valid params" do
         it "creates a new Audit" do