Allow reviewing consent requests

This makes it possible to review for an assessor to review any consent
requests.

app/controllers/assessor_interface/consent_requests_controller.rb

@@ -0,0 +1,67 @@
+# frozen_string_literal: true
+
+module AssessorInterface
+  class ConsentRequestsController < BaseController
+    include HistoryTrackable
+
+    before_action :set_variables
+
+    def edit_review
+      @form = RequestableReviewForm.new(requestable:)
+    end
+
+    def update_review
+      @form =
+        RequestableReviewForm.new(
+          requestable:,
+          user: current_staff,
+          **review_form_params,
+        )
+
+      if @form.save
+        redirect_to [:review, :assessor_interface, application_form, assessment]
+      else
+        render :edit_review, status: :unprocessable_entity
+      end
+    end
+
+    private
+
+    def application_form
+      @application_form ||=
+        ApplicationForm.includes(:assessment).find_by(
+          reference: params[:application_form_reference],
+          assessment: {
+            id: params[:assessment_id],
+          },
+        )
+    end
+
+    def assessment
+      @assessment ||= application_form.assessment
+    end
+
+    def consent_requests
+      @consent_requests ||= assessment.consent_requests
+    end
+
+    def consent_request
+      @consent_request ||= consent_requests.find(params[:id])
+    end
+
+    alias_method :requestable, :consent_request
+
+    def set_variables
+      @consent_request = authorize [:assessor_interface, consent_request]
+      @application_form = application_form
+      @assessment = assessment
+    end
+
+    def review_form_params
+      params.require(:assessor_interface_requestable_review_form).permit(
+        :passed,
+        :note,
+      )
+    end
+  end
+end

app/policies/assessor_interface/consent_request_policy.rb

@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+class AssessorInterface::ConsentRequestPolicy < ApplicationPolicy
+  def update_review?
+    user.assess_permission
+  end
+
+  alias_method :edit_review?, :update_review?
+end

app/views/assessor_interface/consent_requests/edit_review.html.erb

@@ -0,0 +1,41 @@
+<% title = "Review qualification" %>
+
+<% content_for :page_title, title_with_error_prefix(title, error: @form.errors.any?) %>
+<% content_for :back_link_url, back_history_path(default: review_assessor_interface_application_form_assessment_path(@application_form, @assessment)) %>
+
+<%= form_with model: @form, url: [:review, :assessor_interface, @application_form, @assessment, @consent_request] do |f| %>
+  <%= f.govuk_error_summary %>
+
+  <h1 class="govuk-heading-xl"><%= title %></h1>
+
+  <h2 class="govuk-heading-m">
+    <%= qualification_title(@consent_request.qualification) %>
+  </h2>
+
+  <% if @consent_request.expired? && @consent_request.received? %>
+    <%= govuk_inset_text do %>
+      <p>This qualifications’s status has changed from <%= render(StatusTag::Component.new("overdue")) %> to <%= render(StatusTag::Component.new("received")) %>.</p>
+    <% end %>
+
+    <%= govuk_details(summary_text: "See previous notes") do %>
+      <%= govuk_inset_text do %>
+        <h3 class="govuk-heading-s">Internal note</h3>
+        <%= simple_format @consent_request.verify_note %>
+      <% end %>
+    <% end %>
+  <% else %>
+    <%= govuk_inset_text do %>
+      <h3 class="govuk-heading-s">Internal note</h3>
+      <%= simple_format @consent_request.verify_note %>
+    <% end %>
+  <% end %>
+
+  <%= f.govuk_radio_buttons_fieldset :passed, legend: { text: "After review, does the response confirm that this qualification is legitimate?", size: "s" } do %>
+    <%= f.govuk_radio_button :passed, :true, link_errors: true %>
+    <%= f.govuk_radio_button :passed, :false do %>
+      <%= f.govuk_text_area :note, label: { text: "Internal note: briefly explain why the qualification should not be accepted." } %>
+    <% end %>
+  <% end %>
+
+  <%= render "shared/assessor_interface/continue_cancel_button", f: %>
+<% end %>

config/routes.rb

@@ -102,6 +102,13 @@
                  "assessment_recommendation_verify#update_professional_standing"
         end
 
+        resources :consent_requests, path: "/consent-requests", only: [] do
+          member do
+            get "review", to: "consent_requests#edit_review"
+            post "review", to: "consent_requests#update_review"
+          end
+        end
+
         resources :further_information_requests,
                   path: "/further-information-requests",
                   only: %i[new create edit update] do

spec/policies/assessor_interface/consent_request_policy_spec.rb

@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+require "rails_helper"
+
+RSpec.describe AssessorInterface::ConsentRequestPolicy do
+  it_behaves_like "a policy"
+
+  let(:user) { nil }
+  let(:record) { nil }
+
+  subject(:policy) { described_class.new(user, record) }
+
+  describe "#index?" do
+    subject(:index?) { policy.index? }
+    it_behaves_like "a policy method without permission"
+  end
+
+  describe "#show?" do
+    subject(:show?) { policy.show? }
+    it_behaves_like "a policy method without permission"
+  end
+
+  describe "#create?" do
+    subject(:create?) { policy.create? }
+    it_behaves_like "a policy method without permission"
+  end
+
+  describe "#new?" do
+    subject(:new?) { policy.new? }
+    it_behaves_like "a policy method without permission"
+  end
+
+  describe "#update_review?" do
+    subject(:update_review?) { policy.update_review? }
+    it_behaves_like "a policy method requiring the assess permission"
+  end
+
+  describe "#edit_review?" do
+    subject(:edit_review?) { policy.edit_review? }
+    it_behaves_like "a policy method requiring the assess permission"
+  end
+
+  describe "#destroy?" do
+    subject(:destroy?) { policy.destroy? }
+    it_behaves_like "a policy method without permission"
+  end
+end

spec/support/autoload/page_objects/assessor_interface/review_consent_request.rb

@@ -0,0 +1,10 @@
+# frozen_string_literal: true
+
+module PageObjects
+  module AssessorInterface
+    class ReviewConsentRequest < ReviewRequestablePage
+      set_url "/assessor/applications/{reference}/assessments/{assessment_id}" \
+                "/consent-requests/{id}/review"
+    end
+  end
+end

spec/support/page_helpers.rb

@@ -186,6 +186,11 @@ def assessor_reverse_decision_page
       PageObjects::AssessorInterface::ReverseDecision.new
   end
 
+  def assessor_review_consent_request_page
+    @assessor_review_consent_request_page ||=
+      PageObjects::AssessorInterface::ReviewConsentRequest.new
+  end
+
   def assessor_review_further_information_request_page
     @assessor_review_further_information_request_page ||=
       PageObjects::AssessorInterface::ReviewFurtherInformationRequest.new

spec/system/assessor_interface/reviewing_consent_spec.rb

@@ -33,6 +33,37 @@
     )
     and_i_see_the_consent_not_started
 
+    when_i_click_on_the_consent
+    then_i_see_the(
+      :assessor_review_consent_request_page,
+      reference:,
+      assessment_id:,
+    )
+    and_i_see_the_overdue_status
+
+    when_i_submit_yes_on_the_review_form
+    then_i_see_the(
+      :assessor_review_verifications_page,
+      reference:,
+      assessment_id:,
+    )
+    and_i_see_the_consent_accepted
+
+    when_i_click_on_the_consent
+    then_i_see_the(
+      :assessor_review_consent_request_page,
+      reference:,
+      assessment_id:,
+    )
+
+    when_i_submit_no_on_the_review_form
+    then_i_see_the(
+      :assessor_review_verifications_page,
+      reference:,
+      assessment_id:,
+    )
+    and_i_see_the_consent_rejected
+
     when_i_click_on_back_to_overview
     then_i_see_the(:assessor_application_page, reference:)
 
@@ -75,20 +106,44 @@ def when_i_click_on_assessment_decision
     assessor_application_page.assessment_decision_task.click
   end
 
+  def when_i_click_on_the_consent
+    consent_task_item.click
+  end
+
   def and_i_see_the_overdue_status
     expect(assessor_review_verifications_page).to have_content(
       "This qualifications’s status has changed from OVERDUE to RECEIVED",
     )
   end
 
+  def when_i_submit_yes_on_the_review_form
+    assessor_review_reference_request_page.submit_yes
+  end
+
+  def when_i_submit_no_on_the_review_form
+    assessor_review_reference_request_page.submit_no(note: "A note.")
+  end
+
   def when_i_click_on_back_to_overview
     assessor_review_verifications_page.back_to_overview_button.click
   end
 
   def and_i_see_the_consent_not_started
-    item =
-      assessor_review_verifications_page.task_list.find_item("BSc Teaching")
-    expect(item.status_tag.text).to eq("NOT STARTED")
+    expect(consent_task_item.status_tag.text).to eq("NOT STARTED")
+  end
+
+  def and_i_see_the_consent_accepted
+    expect(consent_task_item.status_tag.text).to eq("ACCEPTED")
+  end
+
+  def and_i_see_the_consent_rejected
+    expect(consent_task_item.status_tag.text).to eq("REJECTED")
+  end
+
+  def consent_task_item
+    assessor_review_verifications_page.task_list.find_item(
+      "BSc Teaching (University of Teaching)",
+    )
   end
 
   def application_form
@@ -101,6 +156,7 @@ def application_form
             :completed,
             application_form:,
             title: "BSc Teaching",
+            institution_name: "University of Teaching",
           )
         assessment = create(:assessment, :verify, application_form:)
         create(