fix(vendor-portal): block uplift approval after refusal

Api.SeaHavenIndustries.Tests/UpliftServiceRefusedTests.cs

@@ -0,0 +1,61 @@
+using System.Security.Claims;
+using Data.SeaHavenIndustries;
+using FluentAssertions;
+using Microsoft.Extensions.Options;
+using Moq;
+using SeaHaven.DataServices.Interfaces;
+using SeaHaven.Services.Configuration;
+using SeaHaven.Services.Implementation;
+using Xunit;
+
+namespace Api.SeaHavenIndustries.Tests;
+
+public sealed class UpliftServiceRefusedTests
+{
+    [Fact]
+    public async Task ApproveAsync_RefusedDispatch_RejectsWithoutChangingNteOrRequest()
+    {
+        var request = new DispatchUpliftRequest
+        {
+            Id = 7,
+            DispatchId = 42,
+            Status = "Pending",
+            RequiredTier = 1,
+            RequestedNTE = 900m
+        };
+        var dispatch = new Dispatch
+        {
+            Id = 42,
+            Status = "Refused",
+            NTEAmount = 500m,
+            DispatchNumber = "DSP-42"
+        };
+        var upliftData = new Mock<IUpliftDataService>();
+        upliftData.Setup(data => data.GetByIdAsync(7, It.IsAny<CancellationToken>()))
+            .ReturnsAsync(request);
+        var dispatchData = new Mock<IDispatchDataService>();
+        dispatchData.Setup(data => data.GetByIdAsync(42)).ReturnsAsync(dispatch);
+        var service = new UpliftService(
+            upliftData.Object,
+            dispatchData.Object,
+            Microsoft.Extensions.Options.Options.Create(
+                new ApprovalsOptions { Tier1Roles = new[] { "UpliftApprover" } }));
+        var user = new ClaimsPrincipal(new ClaimsIdentity(
+            new[]
+            {
+                new Claim(ClaimTypes.NameIdentifier, "dispatcher-1"),
+                new Claim(ClaimTypes.Role, "UpliftApprover")
+            },
+            "test"));
+
+        var act = () => service.ApproveAsync(user, 7, "approve", CancellationToken.None);
+
+        await act.Should().ThrowAsync<InvalidOperationException>().WithMessage("*Refused*");
+        dispatch.NTEAmount.Should().Be(500m);
+        request.Status.Should().Be("Pending");
+        dispatchData.Verify(
+            data => data.StageAuditLogAsync(It.IsAny<WorkOrderAuditLog>(), It.IsAny<CancellationToken>()),
+            Times.Never);
+        upliftData.Verify(data => data.SaveChangesAsync(It.IsAny<CancellationToken>()), Times.Never);
+    }
+}

SeaHaven.Services/Implementation/UpliftService.cs

@@ -88,7 +88,7 @@ namespace SeaHaven.Services.Implementation
 
             var dispatch = await _dispatchData.GetByIdAsync(req.DispatchId);
             if (dispatch == null) throw new KeyNotFoundException("Dispatch not found");
-            if (dispatch.Status == "Verified" || dispatch.Status == "Cancelled")
+            if (dispatch.Status == "Verified" || dispatch.Status == "Cancelled" || dispatch.Status == "Refused")
                 throw new InvalidOperationException($"Cannot approve uplift on a '{dispatch.Status}' dispatch");
 
             var userId = user.FindFirst(ClaimTypes.NameIdentifier)?.Value;