Disallow offline spreadsheets from editing records received from the Imms API

app/forms/import_duplicate_form.rb

@@ -35,10 +35,23 @@ def can_keep_both?
   end
 
   def apply_changes_options
-    can_keep_both? ? %w[apply discard keep_both] : %w[apply discard]
+    if can_apply?
+      can_keep_both? ? %w[apply discard keep_both] : %w[apply discard]
+    else
+      %w[discard]
+    end
+  end
+
+  def can_apply?
+    !(
+      object.is_a?(VaccinationRecord) &&
+        object.sourced_from_nhs_immunisations_api?
+    )
   end
 
   def apply_pending_changes!
+    return unless can_apply?
+
     object.patient.apply_pending_changes! if object.respond_to?(:patient)
 
     object.apply_pending_changes!
@@ -51,7 +64,7 @@ def discard_pending_changes!
   end
 
   def keep_both_changes!
-    object.apply_pending_changes_to_new_record! if can_keep_both?
+    object.apply_pending_changes_to_new_record! if can_keep_both? && can_apply?
   end
 
   def reset_count!

app/lib/reports/offline_session_exporter.rb

@@ -263,7 +263,6 @@ def add_patient_cells(row, patient:, programme:)
       patient_specific_directions.dig(patient.id, programme.id)
     triage = triages.dig(patient.id, programme.id)
 
-    row[:organisation_code] = organisation.ods_code
     row[:person_forename] = patient.given_name
     row[:person_surname] = patient.family_name
     row[:person_dob] = patient.date_of_birth
@@ -311,6 +310,8 @@ def add_existing_row_cells(row, vaccination_record:)
     vaccine = vaccination_record.vaccine
     location = session&.location
 
+    row[:organisation_code] = vaccination_record.performed_ods_code
+
     row[:vaccinated] = Cell.new(
       vaccinated(vaccination_record:),
       allowed_values: %w[Y N]
@@ -371,6 +372,8 @@ def add_existing_row_cells(row, vaccination_record:)
   end
 
   def add_new_row_cells(row, patient:, programme:)
+    row[:organisation_code] = organisation.ods_code
+
     row[:vaccinated] = Cell.new(allowed_values: %w[Y N])
     row[:date_of_vaccination] = Cell.new(type: :date)
     row[:school_name] = school_name(location:, patient:)

app/models/concerns/pending_changes_concern.rb

@@ -55,6 +55,12 @@ def apply_pending_changes_to_new_record!
   private
 
   def normalised(value)
-    value.respond_to?(:downcase) ? value.downcase : value
+    if value.respond_to?(:downcase)
+      value.downcase
+    elsif value.is_a?(Time)
+      value.round
+    else
+      value
+    end
   end
 end

app/models/immunisation_import_row.rb

@@ -95,13 +95,16 @@ def to_vaccination_record
     return unless valid?
 
     outcome = (administered ? "administered" : reason_not_administered_value)
-    source = (offline_recording? ? "service" : "historical_upload")
+    source =
+      if imms_api_record?
+        "nhs_immunisations_api"
+      else
+        offline_recording? ? "service" : "historical_upload"
+      end
 
     attributes = {
       dose_sequence: dose_sequence_value,
       full_dose: true,
-      location:,
-      location_name:,
       outcome:,
       patient_id: patient.id,
       performed_at:,
@@ -112,10 +115,12 @@ def to_vaccination_record
       session:,
       supplied_by:
     }
+    attributes.merge!(location:, location_name:) unless imms_api_record?
 
     attributes.merge!(notify_parents: true) if session
 
-    if performed_by_user.nil?
+    if performed_by_user.nil? &&
+         (performed_by_family_name.present? || performed_by_given_name.present?)
       attributes.merge!(
         performed_by_family_name: performed_by_family_name&.to_s,
         performed_by_given_name: performed_by_given_name&.to_s
@@ -135,8 +140,7 @@ def to_vaccination_record
     vaccination_record =
       if uuid.present?
         VaccinationRecord
-          .joins(:team)
-          .find_by!(teams: { id: team.id }, uuid: uuid.to_s)
+          .find_by!(uuid: uuid.to_s)
           .tap { it.stage_changes(attributes) }
       else
         VaccinationRecord.find_or_initialize_by(attributes)
@@ -250,13 +254,13 @@ def location_name
   end
 
   def performed_at
-    data = date_of_vaccination.to_date
+    date = date_of_vaccination.to_date
     time = time_of_vaccination&.to_time
 
     Time.zone.local(
-      data.year,
-      data.month,
-      data.day,
+      date.year,
+      date.month,
+      date.day,
       time&.hour || 0,
       time&.min || 0,
       time&.sec || 0
@@ -326,7 +330,9 @@ def session
   end
 
   def protocol
-    if supplied_by && supplied_by != performed_by_user
+    if imms_api_record?
+      nil
+    elsif supplied_by && supplied_by != performed_by_user
       if patient.patient_specific_directions.exists?(
            programme:,
            academic_year:,
@@ -380,6 +386,13 @@ def programmes_by_name
 
   def offline_recording? = session_id.present?
 
+  def imms_api_record?
+    uuid.present? &&
+      VaccinationRecord.sourced_from_nhs_immunisations_api.exists?(
+        uuid: uuid.to_s
+      )
+  end
+
   def academic_year = date_of_vaccination.to_date.academic_year
 
   def existing_patients
@@ -928,7 +941,15 @@ def validate_school_urn
 
   def validate_session_id
     if session_id.present?
-      if session_id.to_i.nil?
+      if uuid.present? &&
+           VaccinationRecord.sourced_from_nhs_immunisations_api.exists?(
+             uuid: uuid.to_s
+           )
+        errors.add(
+          session_id.header,
+          "A session ID cannot be provided for this record; this record was sourced from an external source."
+        )
+      elsif session_id.to_i.nil?
         errors.add(
           session_id.header,
           "The session ID is not recognised. Download the offline spreadsheet " \
@@ -970,15 +991,16 @@ def validate_time_of_vaccination
   def validate_uuid
     return if uuid.blank?
 
+    scope = VaccinationRecord.left_outer_joins(:session).where(uuid: uuid.to_s)
+
     scope =
-      VaccinationRecord.joins(:team).where(
-        teams: {
-          id: team.id
-        },
-        uuid: uuid.to_s
+      scope.where(sessions: { team: }).or(
+        scope.sourced_from_nhs_immunisations_api
       )
 
-    errors.add(uuid.header, "Enter an existing record.") unless scope.exists?
+    return if scope.exists?
+
+    errors.add(uuid.header, "Enter an existing record.")
   end
 
   def validate_vaccine

app/views/imports/issues/show.html.erb

@@ -43,17 +43,27 @@
       model: @form,
       url: imports_issue_path(@record, type: params[:type]),
       method: :patch,
-      class: "nhsuk-u-width-one-half",
+      class: "nhsuk-u-full-width",
     ) do |f| %>
-  <% content_for(:before_content) { f.govuk_error_summary } %>
+  <% if !@form.can_apply? %>
 
-  <%= f.govuk_collection_radio_buttons :apply_changes,
-                                       @form.apply_changes_options,
-                                       :itself,
-                                       ->(option) { I18n.t(option, scope: "import_duplicate_form.options.label.#{@existing_or_deleted}", type: @type) },
-                                       ->(option) { I18n.t(option, scope: "import_duplicate_form.options.hint.#{@existing_or_deleted}") },
-                                       bold_labels: false,
-                                       small: true %>
+    <h1 class="nhsuk-heading-m">You cannot keep the incoming changes</h1>
 
-  <%= f.govuk_submit "Resolve duplicate" %>
+    <p>The existing record was imported automatically from an external source, such as a GP practice, meaning that Mavis is not the primary source for this vaccination record.</p>
+
+    <%= f.hidden_field :apply_changes, value: "discard" %>
+    <%= f.govuk_submit "Discard incoming changes" %>
+  <% else %>
+    <% content_for(:before_content) { f.govuk_error_summary } %>
+
+    <%= f.govuk_collection_radio_buttons :apply_changes,
+                                         @form.apply_changes_options,
+                                         :itself,
+                                         ->(option) { I18n.t(option, scope: "import_duplicate_form.options.label.#{@existing_or_deleted}", type: @type) },
+                                         ->(option) { I18n.t(option, scope: "import_duplicate_form.options.hint.#{@existing_or_deleted}") },
+                                         bold_labels: false,
+                                         small: true %>
+
+    <%= f.govuk_submit "Resolve duplicate" %>
+  <% end %>
 <% end %>