Ensure a finalized audit can not be edited

While the validation added prevented a finalized
audit to have its status changed, QA showed that
it was possible to edit and audit
that has already been finalized.

With this change, we prevent any edits from being
made to a finalized audit and display a message
for the user to make the experience better.

It also refactors the check to a before_action block
to be reused on any other actions for a finalized
audit and to keep the controller DRY.

Author: stefannibrasil

app/controllers/audits_controller.rb

@@ -2,6 +2,7 @@
 class AuditsController < ApplicationController
   before_action :authorize_admin
   before_action :set_audit, only: %i(show edit update destroy finalize)
+  before_action :ensure_audit_is_editable, only: %i(finalize update)
 
   def index
     @selected_location = filter_params[:at_location]
@@ -36,11 +37,6 @@ def finalize
   end
 
   def update
-    if @audit.reload.finalized?
-      redirect_to audit_path(@audit), error: "This audit has been finalized and cannot be edited."
-      return
-    end
-
     @audit.line_items.destroy_all
     if @audit.update(audit_params)
       save_audit_status_and_redirect(params)
@@ -85,6 +81,12 @@ def destroy
 
   private
 
+  def ensure_audit_is_editable
+    if @audit.reload.finalized?
+      redirect_to audit_path(@audit), error: "This audit has been finalized and cannot be edited."
+    end
+  end
+
   def handle_audit_errors
     error_message = @audit.errors.uniq(&:attribute).map do |error|
       attr = (error.attribute.to_s == 'base') ? '' : error.attribute.capitalize

spec/requests/audits_requests_spec.rb

@@ -203,6 +203,19 @@
         expect(audit.reload).to be_finalized
         expect(AuditEvent.count).to eq(1)
       end
+
+      context "when the audit has already been finalized" do
+        it "does not create a new AuditEvent and redirects to the finalized audit" do
+          finalized_audit = create(:audit, organization: organization, status: :finalized)
+
+          expect do
+            post audit_finalize_path(audit_id: finalized_audit.to_param)
+          end.not_to change(AuditEvent, :count)
+
+          expect(response).to redirect_to(audit_path(finalized_audit))
+          expect(flash[:error]).to include("This audit has been finalized and cannot be edited.")
+        end
+      end
     end
 
     describe "DELETE #destroy" do