Generate consent status from submitted at time

This changes how we determine the most recent consent response from the
`created_at` to the `submitted_at`. In most cases these values will be
the same, but it's possible for a consent to be matched with a patient
manually which can occur some period of time after the consent was
submitted.

In particular, it's possible to manually match multiple consents in a
different order to when they were submitted, which can lead to bugs
where the patient is given the wrong consent status.

Author: thomasleese

app/lib/consent_grouper.rb

@@ -15,15 +15,15 @@ def call
         .reject(&:invalidated?)
         .select(&:response_provided?)
         .group_by(&:name)
-        .map { it.second.max_by(&:created_at) }
+        .map { it.second.max_by(&:submitted_at) }
     else
       consents
         .where(programme_id:)
         .not_invalidated
         .response_provided
         .includes(:parent)
         .group_by(&:name)
-        .map { it.second.max_by(&:created_at) }
+        .map { it.second.max_by(&:submitted_at) }
     end
   end
 

spec/models/patient/consent_status_spec.rb

@@ -102,6 +102,29 @@
       it { should be(:given) }
     end
 
+    context "with a refused and given consent from the same parent at different times" do
+      before do
+        create(
+          :consent,
+          :refused,
+          patient:,
+          programme:,
+          created_at: 1.day.ago,
+          submitted_at: 2.days.ago
+        )
+        create(
+          :consent,
+          :given,
+          patient:,
+          programme:,
+          created_at: 2.days.ago,
+          submitted_at: 1.day.ago
+        )
+      end
+
+      it { should be(:given) }
+    end
+
     context "with self-consent" do
       before { create(:consent, :self_consent, :given, patient:, programme:) }