From 4db6570039d0bda583d55b6395a638951b8d3f48 Mon Sep 17 00:00:00 2001
From: Ryan Murphy <murjax@gmail.com>
Date: Wed, 27 Sep 2023 19:49:31 -0400
Subject: [PATCH] 9235: Prevent customers from editing shipped orders

---
 app/models/spree/order.rb       |  5 ++-
 spec/models/spree/order_spec.rb | 64 +++++++++++++++++++++++++++++++++
 2 files changed, 68 insertions(+), 1 deletion(-)

diff --git a/app/models/spree/order.rb b/app/models/spree/order.rb
index 64c5aa60c0..c2ce1404bd 100644
--- a/app/models/spree/order.rb
+++ b/app/models/spree/order.rb
@@ -225,7 +225,10 @@ module Spree
     end
 
     def changes_allowed?
-      complete? && distributor&.allow_order_changes? && order_cycle&.open?
+      !!(complete? &&
+         !shipped? &&
+         distributor&.allow_order_changes? &&
+         order_cycle&.open?)
     end
 
     # Is this a free order in which case the payment step should be skipped
diff --git a/spec/models/spree/order_spec.rb b/spec/models/spree/order_spec.rb
index a813e14bc2..b2544ce910 100644
--- a/spec/models/spree/order_spec.rb
+++ b/spec/models/spree/order_spec.rb
@@ -157,6 +157,70 @@ describe Spree::Order do
     end
   end
 
+  context '#changes_allowed?' do
+    let(:order) { create(:order_ready_for_details) }
+    let(:complete) { true }
+    let(:shipped) { false }
+    let(:distributor_allow_changes) { true }
+    let(:order_cycle_open) { true }
+
+    subject { order.changes_allowed? }
+
+    before do
+      allow(order).to receive(:complete?).and_return(complete)
+      allow(order).to receive(:shipped?).and_return(shipped)
+      allow_any_instance_of(Enterprise).to receive(:allow_order_changes?).and_return(
+        distributor_allow_changes
+      )
+      allow_any_instance_of(OrderCycle).to receive(:open?).and_return(order_cycle_open)
+    end
+
+    context 'valid conditions' do
+      let(:complete) { true }
+      let(:shipped) { false }
+      let(:distributor_allow_changes) { true }
+      let(:order_cycle_open) { true }
+
+      it { is_expected.to eq(true) }
+    end
+
+    context 'already shipped' do
+      let(:shipped) { true }
+
+      it { is_expected.to eq(false) }
+    end
+
+    context 'not complete' do
+      let(:complete) { false }
+
+      it { is_expected.to eq(false) }
+    end
+
+    context 'distributor changes not allowed' do
+      let(:distributor_allow_changes) { false }
+
+      it { is_expected.to eq(false) }
+    end
+
+    context 'order does not have distributor' do
+      let(:order) { build(:order, distributor: nil, order_cycle: build(:order_cycle)) }
+
+      it { is_expected.to eq(false) }
+    end
+
+    context 'order cycle not open' do
+      let(:order_cycle_open) { false }
+
+      it { is_expected.to eq(false) }
+    end
+
+    context 'order does not have order cycle' do
+      let(:order) { build(:order, distributor: build(:distributor_enterprise), order_cycle: nil) }
+
+      it { is_expected.to eq(false) }
+    end
+  end
+
   context "checking if order is paid" do
     context "payment_state is paid" do
       before { allow(order).to receive_messages payment_state: 'paid' }