Add validation on programmes

For models which have a relation to programmes and sessions, we need to
validate that the programme is one of the programmes in the session.

It's difficult to do this purely through the database structure because
we have many to many relationships between programmes and sessions and
sessions and patients; while the triage and vaccination record model
needs a reference to all three in one record.

app/models/consent_form.rb

@@ -120,6 +120,8 @@ class ConsentForm < ApplicationRecord
   normalizes :parent_email,
              with: -> { _1.blank? ? nil : _1.to_s.downcase.strip }
 
+  validates :programme, inclusion: { in: -> { _1.session.programmes } }
+
   validates :address_line_1,
             :address_line_2,
             :address_town,

app/models/session.rb

@@ -64,6 +64,8 @@ class Session < ApplicationRecord
   after_initialize :set_timeline_attributes
   after_validation :set_timeline_timestamps
 
+  validate :programmes_part_of_team
+
   on_wizard_step :location, exact: true do
     validates :location_id, presence: true
   end
@@ -127,6 +129,12 @@ def open_for_consent?
 
   private
 
+  def programmes_part_of_team
+    return if programmes.empty?
+
+    errors.add(:programmes, :inclusion) if programmes.map(&:team).uniq != [team]
+  end
+
   def set_timeline_attributes
     unless send_consent_reminders_at.nil?
       if send_consent_requests_at + DEFAULT_DAYS_FOR_REMINDER.days ==

app/models/triage.rb

@@ -50,5 +50,7 @@ class Triage < ApplicationRecord
 
   encrypts :notes
 
+  validates :programme, inclusion: { in: -> { _1.patient_session.programmes } }
+
   validates :notes, length: { maximum: 1000 }
 end

app/models/vaccination_record.rb

@@ -118,6 +118,8 @@ class VaccinationRecord < ApplicationRecord
 
   encrypts :notes
 
+  validates :programme, inclusion: { in: -> { _1.patient_session.programmes } }
+
   validates :notes, length: { maximum: 1000 }
 
   validates :delivery_site,

spec/components/app_activity_log_component_spec.rb

@@ -60,6 +60,7 @@
     create(
       :triage,
       :needs_follow_up,
+      programme:,
       patient_session:,
       created_at: Time.zone.parse("2024-05-30 14:00"),
       notes: "Some notes",
@@ -68,6 +69,7 @@
     create(
       :triage,
       :ready_to_vaccinate,
+      programme:,
       patient_session:,
       created_at: Time.zone.parse("2024-05-30 14:30"),
       performed_by: user

spec/components/app_session_patient_table_component_spec.rb

@@ -60,7 +60,11 @@ def have_column(text)
         patient_sessions:,
         section: :matching,
         consent_form:
-          create(:consent_form, session: patient_sessions.first.session),
+          create(
+            :consent_form,
+            programme:,
+            session: patient_sessions.first.session
+          ),
         columns: %i[name postcode dob select_for_matching]
       )
     end

spec/components/app_triage_form_component_spec.rb

@@ -3,7 +3,8 @@
 describe AppTriageFormComponent, type: :component do
   subject(:rendered) { render_inline(component) }
 
-  let(:patient_session) { create(:patient_session) }
+  let(:programme) { create(:programme) }
+  let(:patient_session) { create(:patient_session, programme:) }
   let(:component) { described_class.new(patient_session:, url: "#") }
 
   it { should have_text("Is it safe to vaccinate") }
@@ -19,7 +20,7 @@
     end
 
     context "patient_session has existing triage" do
-      before { create(:triage, :needs_follow_up, patient_session:) }
+      before { create(:triage, :needs_follow_up, programme:, patient_session:) }
 
       it { should_not be_nil }
       it { should be_needs_follow_up }

spec/components/app_triage_notes_component_spec.rb

@@ -4,7 +4,9 @@
   subject(:rendered) { render_inline(component) }
 
   let(:component) { described_class.new(patient_session:) }
-  let(:patient_session) { create(:patient_session) }
+
+  let(:programme) { create(:programme) }
+  let(:patient_session) { create(:patient_session, programme:) }
 
   context "triage notes are not present" do
     it "does not render" do
@@ -23,6 +25,7 @@
       create(
         :triage,
         :ready_to_vaccinate,
+        programme:,
         notes: "Some notes",
         patient_session:,
         performed_by:
@@ -41,7 +44,7 @@
   end
 
   context "multiple triage notes are present" do
-    before { create_list(:triage, 2, patient_session:) }
+    before { create_list(:triage, 2, programme:, patient_session:) }
 
     it "renders" do
       expect(component).to be_render

spec/components/app_vaccination_record_summary_component_spec.rb

@@ -22,6 +22,7 @@
   let(:vaccination_record) do
     create(
       :vaccination_record,
+      programme:,
       administered_at:,
       batch:,
       vaccine:,

spec/components/app_vaccination_record_table_component_spec.rb

@@ -10,6 +10,7 @@
     [
       create(
         :vaccination_record,
+        programme:,
         administered_at: Time.zone.local(2020, 9, 1),
         patient:
           create(

spec/components/previews/app_session_patient_table_component_preview.rb

@@ -19,7 +19,9 @@ def check_consent
   end
 
   def matching_consent_form_to_a_patient
-    patient_sessions = create_list(:patient_session, 2, :added_to_session)
+    programme = create(:programme)
+    patient_sessions =
+      create_list(:patient_session, 2, :added_to_session, programme:)
 
     # add a common name to one of the patients above
     patient_sessions.first.patient.update!(common_name: "Bobby")
@@ -30,7 +32,7 @@ def matching_consent_form_to_a_patient
     end
 
     consent_form =
-      create(:consent_form, session: patient_sessions.first.session)
+      create(:consent_form, programme:, session: patient_sessions.first.session)
 
     render AppSessionPatientTableComponent.new(
              patient_sessions:,

spec/controllers/concerns/patient_sorting_concern_spec.rb

@@ -24,13 +24,32 @@ def initialize(params)
     create(:patient, first_name: "Casey", date_of_birth: Date.new(2010, 1, 3))
   end
 
-  let(:session) { create(:session) }
+  let(:programme) { create(:programme) }
+  let(:session) { create(:session, programme:) }
 
   let(:patient_sessions) do
     [
-      create(:patient_session, :added_to_session, patient: alex, session:),
-      create(:patient_session, :delay_vaccination, patient: blair, session:),
-      create(:patient_session, :vaccinated, patient: casey, session:)
+      create(
+        :patient_session,
+        :added_to_session,
+        patient: alex,
+        programme:,
+        session:
+      ),
+      create(
+        :patient_session,
+        :delay_vaccination,
+        patient: blair,
+        programme:,
+        session:
+      ),
+      create(
+        :patient_session,
+        :vaccinated,
+        patient: casey,
+        programme:,
+        session:
+      )
     ]
   end
 

spec/controllers/concerns/vaccination_mailer_concern_spec.rb

@@ -14,7 +14,9 @@
     let(:consent) { create(:consent, :given, :recorded, programme:, route:) }
     let(:patient) { create(:patient, consents: [consent]) }
     let(:patient_session) { create(:patient_session, session:, patient:) }
-    let(:vaccination_record) { create(:vaccination_record, patient_session:) }
+    let(:vaccination_record) do
+      create(:vaccination_record, programme:, patient_session:)
+    end
 
     context "when the vaccination has taken place" do
       it "sends an email" do
@@ -33,7 +35,12 @@
 
     context "when the vaccination hasn't taken place" do
       let(:vaccination_record) do
-        create(:vaccination_record, :not_administered, patient_session:)
+        create(
+          :vaccination_record,
+          :not_administered,
+          programme:,
+          patient_session:
+        )
       end
 
       it "sends an email" do
@@ -52,7 +59,9 @@
 
     context "when the consent was done through gillick assessment" do
       let(:route) { "self_consent" }
-      let(:vaccination_record) { create(:vaccination_record, patient_session:) }
+      let(:vaccination_record) do
+        create(:vaccination_record, programme:, patient_session:)
+      end
 
       it "doesn't send an email" do
         expect { send_vaccination_confirmation }.not_to have_enqueued_mail

spec/factories/patient_sessions.rb

@@ -101,6 +101,7 @@
           association(
             :triage,
             :ready_to_vaccinate,
+            programme:,
             notes: "Okay to vaccinate",
             performed_by: created_by
           )
@@ -117,7 +118,14 @@
       end
 
       triage do
-        [association(:triage, :do_not_vaccinate, performed_by: created_by)]
+        [
+          association(
+            :triage,
+            :do_not_vaccinate,
+            programme:,
+            performed_by: created_by
+          )
+        ]
       end
     end
 
@@ -130,7 +138,14 @@
       end
 
       triage do
-        [association(:triage, :needs_follow_up, performed_by: created_by)]
+        [
+          association(
+            :triage,
+            :needs_follow_up,
+            programme:,
+            performed_by: created_by
+          )
+        ]
       end
     end
 
@@ -143,7 +158,14 @@
       end
 
       triage do
-        [association(:triage, :delay_vaccination, performed_by: created_by)]
+        [
+          association(
+            :triage,
+            :delay_vaccination,
+            programme:,
+            performed_by: created_by
+          )
+        ]
       end
 
       vaccination_records do
@@ -178,7 +200,14 @@
       end
 
       triage do
-        [association(:triage, :ready_to_vaccinate, performed_by: created_by)]
+        [
+          association(
+            :triage,
+            :ready_to_vaccinate,
+            programme:,
+            performed_by: created_by
+          )
+        ]
       end
 
       vaccination_records do
@@ -206,7 +235,14 @@
       end
 
       triage do
-        [association(:triage, :ready_to_vaccinate, performed_by: created_by)]
+        [
+          association(
+            :triage,
+            :ready_to_vaccinate,
+            programme:,
+            performed_by: created_by
+          )
+        ]
       end
 
       vaccination_records do
@@ -232,7 +268,14 @@
       end
 
       triage do
-        [association(:triage, :ready_to_vaccinate, performed_by: created_by)]
+        [
+          association(
+            :triage,
+            :ready_to_vaccinate,
+            programme:,
+            performed_by: created_by
+          )
+        ]
       end
 
       vaccination_records do

spec/factories/sessions.rb

@@ -26,10 +26,10 @@
 #
 FactoryBot.define do
   factory :session do
-    transient { programme { association :programme, team: } }
+    transient { programme { association :programme } }
 
-    team
     programmes { [programme] }
+    team { programmes.first&.team || association(:team) }
     location { association :location, :school }
 
     date { Time.zone.today }

spec/factories/vaccination_records.rb

@@ -44,11 +44,13 @@
   factory :vaccination_record do
     transient do
       session { association :session, programme: }
-      patient { association :patient }
+      patient { association :patient, school: session.location }
     end
 
     programme
-    patient_session { association :patient_session, patient:, session: }
+    patient_session do
+      association :patient_session, programme:, patient:, session:
+    end
 
     recorded_at { "2023-06-09" }
     delivery_site { "left_arm_upper_position" }

spec/mailers/consent_mailer_spec.rb

@@ -6,13 +6,15 @@
       described_class.with(consent_form:).confirmation_injection
     end
 
+    let(:programme) { create(:programme, :flu) }
     let(:consent_form) do
       create(
         :consent_form,
         :recorded,
         :refused,
         reason: :contains_gelatine,
-        session: create(:session, programme: create(:programme, :flu))
+        programme:,
+        session: create(:session, programme:)
       )
     end