Fix race condition allowing vaccination records when patient marked absent

Adds validation to prevent creating vaccination records for patients
marked as not attending a session. Previously, a race condition existed
where a vaccination could be confirmed after a patient was marked absent
in another tab or by another user.

The validation now checks attendance status at the confirmation step and
displays an error message prompting users to mark the patient as
attending before proceeding.

Jira-Issue: MAV-1212

Author: jhenderson

app/models/draft_vaccination_record.rb

@@ -134,6 +134,7 @@ def wizard_steps
   on_wizard_step :confirm, exact: true do
     validates :outcome, presence: true
     validates :notes, length: { maximum: 1000 }
+    validate :validate_patient_attendance
   end
 
   on_wizard_step :vaccinator, exact: true do
@@ -507,4 +508,23 @@ def delivery_site_matches_delivery_method
       errors.add(:delivery_site, :inclusion)
     end
   end
+
+  def validate_patient_attendance
+    return unless new_record?
+    return unless session&.today?
+    return if patient.blank?
+
+    attendance_record =
+      patient.attendance_records.find_by(
+        location: session.location,
+        date: session.dates.find(&:today?)
+      )
+
+    return if attendance_record&.attending?
+
+    errors.add(
+      :base,
+      "Child is marked as not attending this session. Mark them as attending to record a vaccination."
+    )
+  end
 end

spec/features/flu_vaccination_hca_national_protocol_spec.rb

@@ -97,18 +97,21 @@ def and_patients_exist
     @patient_nasal_only =
       create(
         :patient,
+        :in_attendance,
         :consent_given_nasal_only_triage_not_needed,
         session: @session
       )
     @patient_nasal_and_injection =
       create(
         :patient,
+        :in_attendance,
         :consent_given_nasal_or_injection_triage_not_needed,
         session: @session
       )
     @patient_injection_only =
       create(
         :patient,
+        :in_attendance,
         :consent_given_injection_only_triage_not_needed,
         session: @session
       )

spec/features/flu_vaccination_hca_pgd_supply_spec.rb

@@ -73,18 +73,21 @@ def and_patients_exist
     @patient_nasal_only =
       create(
         :patient,
+        :in_attendance,
         :consent_given_nasal_only_triage_not_needed,
         session: @session
       )
     @patient_nasal_and_injection =
       create(
         :patient,
+        :in_attendance,
         :consent_given_nasal_or_injection_triage_not_needed,
         session: @session
       )
     @patient_injection_only =
       create(
         :patient,
+        :in_attendance,
         :consent_given_injection_only_triage_not_needed,
         session: @session
       )
@@ -103,6 +106,7 @@ def and_a_nasal_patient_exists_with_health_issues_marked_safe_vaccinate_with_nas
     @patient_nasal_only =
       create(
         :patient,
+        :in_attendance,
         :consent_given_nasal_triage_safe_to_vaccinate_nasal,
         session: @session
       )

spec/features/flu_vaccination_hca_psd_spec.rb

@@ -118,6 +118,7 @@ def and_patients_exist
       create(
         :patient,
         :consent_given_nasal_only_triage_not_needed,
+        :in_attendance,
         session: @session
       )
     @patient_injection_only =

spec/models/draft_vaccination_record_spec.rb

@@ -12,7 +12,7 @@
 
   let(:programme) { Programme.hpv }
   let(:session) { create(:session, team:, programmes: [programme]) }
-  let(:patient) { create(:patient, session:) }
+  let(:patient) { create(:patient, :in_attendance, session:) }
   let(:vaccine) { programme.vaccines.first }
   let(:batch) { create(:batch, team:, vaccine:, expiry: Date.new(2026, 11, 1)) }
 
@@ -128,6 +128,42 @@
       it { should validate_length_of(:notes).is_at_most(1000).on(:update) }
     end
 
+    context "when the patient is marked not attending" do
+      let(:attributes) { valid_administered_attributes }
+      let(:patient) { create(:patient, session:) }
+
+      before do
+        draft_vaccination_record.wizard_step = :confirm
+        create(:attendance_record, :today, :absent, patient:, session:)
+      end
+
+      it "raises an error when attempting to save the record" do
+        expect(draft_vaccination_record.save(context: :update)).to be(false)
+        expect(draft_vaccination_record.errors[:base]).to include(
+          "Child is marked as not attending this session. Mark them as attending to record a vaccination."
+        )
+      end
+
+      context "when editing an existing vaccination record" do
+        let(:existing_vaccination_record) do
+          create(:vaccination_record, patient:, session:)
+        end
+
+        let(:attributes) do
+          valid_administered_attributes.merge(
+            editing_id: existing_vaccination_record.id
+          )
+        end
+
+        it "does not raise an attendance error" do
+          expect(draft_vaccination_record.save(context: :update)).to be(true)
+          expect(draft_vaccination_record.errors[:base]).not_to include(
+            "Child is marked as not attending this session. Mark them as attending to record a vaccination."
+          )
+        end
+      end
+    end
+
     context "on delivery step" do
       let(:attributes) { valid_administered_attributes }