justin/new-site
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

admin approve: block filing when intake incomplete (force override + warning)

Browse source 
Paul Wilson's UCR (CO-FE07212A) sat at fulfillment_status=ready_to_file with
intake_data_validated=false, so the Approve & File button would have dispatched
it for government submission with incomplete intake and no document to review.

Backend: /approve now refuses an order whose intake_data_validated is false
unless {force:true} is passed (409 code=intake_incomplete); the override is
recorded in order_audit_log. The fulfillment_status=ready_to_file requirement
is unchanged, so awaiting_intake orders (e.g. Mitchell's MCS-150s) still 409.

UI: the drawer shows an amber 'intake not complete' warning above the approve
button, and approving an intake-incomplete order triggers an explicit
override confirmation before sending force=true.
This commit is contained in:
justin 2026-06-16 00:33:22 -05:00
parent aa498fdfdf
commit d18de006d8
2 changed files with 39 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

20
api/src/routes/admin.ts
View file

@ -474,7 +474,8 @@ router.post("/api/v1/admin/compliance-orders/:order_number/approve", requireAdmi
const id = req.params.order_number;
try {
const { rows } = await pool.query(
`SELECT order_number, service_slug, fulfillment_status
`SELECT order_number, service_slug, fulfillment_status,
COALESCE(intake_data_validated, FALSE) AS intake_data_validated
FROM compliance_orders WHERE order_number = $1`,
[id],
);
@ -486,6 +487,17 @@ router.post("/api/v1/admin/compliance-orders/:order_number/approve", requireAdmi
});
return;
}
// Safety gate: never let an order be filed while its intake is still
// incomplete (e.g. an admin-assisted service parked at ready_to_file before
// the customer finished intake). The caller must pass {force:true} to
// override, which is logged in the audit trail.
if (!order.intake_data_validated && req.body?.force !== true) {
res.status(409).json({
error: "Intake is not complete for this order. Review the documents and resend the intake reminder, or pass force to override.",
code: "intake_incomplete",
});
return;
}
await pool.query(
`UPDATE compliance_orders
@ -496,7 +508,11 @@ router.post("/api/v1/admin/compliance-orders/:order_number/approve", requireAdmi
await pool.query(
`INSERT INTO order_audit_log (order_type, order_id, order_number, action, from_status, to_status, actor_type, actor_id, actor_name, note)
VALUES ('compliance', 0, $1, 'approved_for_submission', 'ready_to_file', 'authorization_signed', 'admin', $2, $3, $4)`,
[id, req.admin!.id, req.admin!.username, (req.body?.note as string) || "Approved + dispatched for government submission"],
[id, req.admin!.id, req.admin!.username,
(req.body?.note as string)
|| (order.intake_data_validated
? "Approved + dispatched for government submission"
: "Approved + dispatched (intake-incomplete override)")],
);
const workerUrl = process.env.WORKER_URL || "http://workers:8090";