Mettre en place le report des décisions d'attribution

[gtournadre]

Le report de décision d'attribution permet à un élève d'effectuer une PFMP après la fin de l'année scolaire de référence. Principe : au niveau de la scolarité, il faut pouvoir saisir une demande de report de DA, et pouvoir saisir au moins une date de fin de report. Considérations à prendre en compte :

• Le montant à payer pour la PFMP est calculé selon les WAGES de la schooling précédente et le contrôle de plafond est aussi basé sur les plafonds de la Schooling précédente.
• Il faut revoir le job de validation des Payment Requests : Les dates d'une PFMP doivent être comprises entre le début et la fin de l'année scolaire (startDate et endDate de Schoolings), quand il y a un report, les dates de début et de fin de la PFMP doivent être comprise entre la date de début de la Schooling de la PFMP et la date de fin du report).
• Idéalement, Il faut pouvoir rééditer la DA avec la nouvelle date de fin d'effet.

Si il y a un report, les dates de la PFMP doivent être comprise entre startDate de Schooling et endDate du report. Voir le document en PJ pour avoir une idée.

[gtournadre]

Report_DA.pdf

[gtournadre]

Pour simplifier, cela consiste à ajouter une date report DA dans Schoolings

[pskl]

TODO:

• Nom du champ: "extended_end_date", type: date
• 1 formulaire d'input de dates -> sur une nouvelle page: aplypro/app/views/schoolings/confirm_da_extension.html.haml
• possibilité d'annuler l'extension (reset le field à null) sauf si une pfmp s'est glissée entre-temps dans la période
• 1 modification d'un check dans le validator ASP::PaymentRequestValidator: -> soit une nouvelle méthode -> soit changer l'implémentation de check_da_abrogation et la renommer en un truc du genre "check_eligibility" ou ajouter cette nouvelle méthode
• modification de l'update des montants dans la PFMP? (à étudier)

[pskl]

# frozen_string_literal: true

require "sidekiq/web"

# rubocop:disable Metrics/BlockLength
Rails.application.routes.draw do
  namespace :asp do
    resources :schoolings, only: :index

    devise_for :users, skip: :all, class_name: "ASP::User"
  end

  # this allows overriding the redirect-if-not-logged-in path that
  # Devise automatically looks for with "new_#{resource}_session_url"
  # path[1], but we need to get it out of the scoped block above
  # otherwise it ends up being `asp_new_asp_user_session_path`.

  # [1]: https://github.com/heartcombo/devise/blob/bb18f4d3805be0bf5f45e21be39625c7cfd9c1d6/lib/devise/failure_app.rb#L140
  get "asp/login", to: "asp/application#login", as: :new_asp_user_session

  delete "asp/logout", to: "asp/application#logout", as: :destroy_asp_user_session

  resources :users, only: :update do
    get "select_establishment"
  end

  resources :establishments, only: %w[edit update] do
    resources :invitations
  end

  resources :students, only: %i[show] do
    resources :ribs, only: %i[new create destroy update edit] do
      member do
        get "confirm_deletion"
      end
    end
  end

  resources :school_years, path: :year, only: [] do
    get "selected"

    collection do
      get "select"
    end

    get "/home", to: "home#home"

    resources :establishments, only: [] do
      post "create_attributive_decisions"
      post "reissue_attributive_decisions"
      post "download_attributive_decisions"
    end

    resources :classes, only: %i[show index] do
      member do
        get "bulk_pfmp"
        post "create_bulk_pfmp"
        get "bulk_pfmp_completion"
        put "update_bulk_pfmp"
        get "validation", to: "validations#show"
        post "validation", to: "validations#validate"
      end

      resources :ribs, only: [] do
        collection do
          get "missing"
          post "bulk_create"
        end
      end

      resources :schoolings, only: [:update] do
        member do
          get "confirm_abrogation"
          delete "abrogate_decision"
          get "confirm_da_extension"
        end

        resources :pfmps, except: :index do
          member do
            post :validate
            get :confirm_deletion
            get :confirm_rectification
            post :rectify
            resources :payment_requests, only: %i[create update]
          end
        end
      end
    end

    resources :validations, only: :index
  end

  devise_scope :asp_user do
    get "/auth/asp/callback" => "users/omniauth_callbacks#asp", as: :asp_login
  end

  devise_for :users

  devise_scope :user do
    %w[fim masa developer].each do |action|
      match "/users/auth/#{action}/callback", to: "users/omniauth_callbacks##{action}", via: %i[get post]
    end

    get "login", to: "home#login", as: :new_user_session
    delete "sign_out", to: "devise/sessions#destroy", as: :destroy_user_session
  end

  root "home#index"

  get "/welcome", to: "home#welcome"
  get "/home", to: "home#home"
  get "/accessibility", to: "home#accessibility"

  get "/maintenance", to: "home#maintenance"
  get "/legal", to: "home#legal"
  get "/faq", to: "home#faq"

  resources :stats, only: [:index] do
    collection do
      get "paid_pfmps_per_month"
    end
  end

  if Rails.env.production?
    Sidekiq::Web.use(Rack::Auth::Basic) do |user, password|
      # https://github.com/sidekiq/sidekiq/wiki/Monitoring#rails-http-basic-auth-from-routes
      # Protect against timing attacks:
      # - See https://codahale.com/a-lesson-in-timing-attacks/
      # - See https://thisdata.com/blog/timing-attacks-against-string-comparison/
      # - Use & (do not use &&) so that it doesn't short circuit.
      # - Use digests to stop length information leaking

      allowed_user = Digest::SHA256.hexdigest(ENV.fetch("APLYPRO_SIDEKIQ_USER", nil))
      allowed_password = Digest::SHA256.hexdigest(ENV.fetch("APLYPRO_SIDEKIQ_PASSWORD", nil))

      Rack::Utils.secure_compare(Digest::SHA256.hexdigest(user), allowed_user) &
        Rack::Utils.secure_compare(Digest::SHA256.hexdigest(password), allowed_password)
    end
  end

  mount Sidekiq::Web => "/sidekiq"
end
# rubocop:enable Metrics/BlockLength

# frozen_string_literal: true

class SchoolingsController < ApplicationController
  include RoleCheck

  before_action :authenticate_user!, :set_classe, :set_schooling
  before_action :check_director, :update_confirmed_director!, :check_confirmed_director, only: %i[abrogate_decision]

  def abrogate_decision
    GenerateAbrogationDecisionJob.perform_now(@schooling)

    retry_eligibile_payment_requests!

    redirect_to student_path(@schooling.student),
                notice: t("flash.da.abrogated", name: @schooling.student.full_name)
  end

  def confirm_abrogation; end

  def update
    if @schooling.save
    else
      render :edit, status: :unprocessable_entity
    end
  end

  def confirm_da_extension
  end

  private

  def set_schooling
    @schooling = Schooling.find(params[:id])
  rescue ActiveRecord::RecordNotFound
    redirect_to @classe, alert: t("errors.schoolings.not_found")
  end

  def set_classe
    @classe = Classe
              .where(establishment: current_establishment)
              .find(params[:class_id])
  rescue ActiveRecord::RecordNotFound
    redirect_to school_year_classes_path(selected_school_year),
                alert: t("errors.classes.not_found") and return
  end

  def retry_eligibile_payment_requests!
    @schooling.pfmps.in_state(:validated).each do |pfmp|
      payment_request = pfmp.latest_payment_request
      payment_request.mark_ready! if payment_request.eligible_for_auto_retry?
    end
  end
end