CDPT-1932 London disclosure ICO SAR appeal decision update

.github/workflows/test.yml

@@ -156,7 +156,7 @@ jobs:
         uses: joshmfrankel/simplecov-check-action@main
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
-          minimum_suite_coverage: 92.8
+          minimum_suite_coverage: 94
           minimum_file_coverage: 100
 
   build-and-deploy:

Gemfile

@@ -101,7 +101,7 @@ group :development, :test do
   gem "parallel_tests"
   gem "phantomjs"
   gem "rspec-collection_matchers"
-  gem "rspec-rails", "~> 6.0"
+  gem "rspec-rails"
   gem "rubocop-govuk", require: false
   gem "selenium-webdriver"
   gem "teaspoon-jasmine"

Gemfile.lock

@@ -460,10 +460,10 @@ GEM
     rspec-mocks (3.13.2)
       diff-lcs (>= 1.2.0, < 2.0)
       rspec-support (~> 3.13.0)
-    rspec-rails (6.1.5)
-      actionpack (>= 6.1)
-      activesupport (>= 6.1)
-      railties (>= 6.1)
+    rspec-rails (7.1.0)
+      actionpack (>= 7.0)
+      activesupport (>= 7.0)
+      railties (>= 7.0)
       rspec-core (~> 3.13)
       rspec-expectations (~> 3.13)
       rspec-mocks (~> 3.13)
@@ -686,7 +686,7 @@ DEPENDENCIES
   rails-data-migrations
   recursive-open-struct
   rspec-collection_matchers
-  rspec-rails (~> 6.0)
+  rspec-rails
   rubocop-govuk
   ruby-progressbar
   rubyzip (>= 1.2.4)

app/controllers/cases/ico_controller.rb

@@ -4,7 +4,7 @@ class ICOController < CasesController
     include NewCase
     include ReopenICOCase
 
-    before_action -> { set_case(params[:id]) }, only: [:record_late_team]
+    before_action -> { set_decorated_case(params[:id]) }, only: [:record_late_team]
 
     def initialize
       @correspondence_type = CorrespondenceType.ico
@@ -51,11 +51,15 @@ def record_late_team
       @case.prepare_for_recording_late_team
       params = record_late_team_params(@case.type_abbreviation)
       if @case.update(params)
-        @case.respond(current_user)
-        redirect_to case_path
+        if @case.is_a?(Case::ICO::SAR)
+          redirect_to record_sar_complaint_outcome_case_ico_path(@case)
+        else
+          @case.respond(current_user)
+          redirect_to case_path
+        end
       else
         @team_collection = CaseTeamCollection.new(@case)
-        render "/cases/ico/late_team"
+        render :late_team
       end
     end
 

app/controllers/cases/ico_sar_controller.rb

@@ -1,7 +1,7 @@
 module Cases
   class ICOSARController < ICOController
-    # this class needs to exist because of autogenerated routes
-    # for correspondence_type_resources - see routes.rb#55 etc
+    before_action -> { set_decorated_case(params[:id]) }, only: %i[record_complaint_outcome confirm_record_complaint_outcome]
+
     def new
       authorize case_type, :can_add_case?
 
@@ -12,5 +12,21 @@ def new
     def case_type
       Case::ICO::SAR
     end
+
+    def record_complaint_outcome
+      authorize @case, :can_set_outcome?
+      render "cases/ico/sar/record_complaint_outcome"
+    end
+
+    def confirm_record_complaint_outcome
+      authorize @case, :can_set_outcome?
+      @case.prepare_for_recording_outcome
+      if @case.update(record_complaint_outcome_params)
+        @case.respond(current_user)
+        redirect_to case_path(@case)
+      else
+        render "cases/ico/sar/record_complaint_outcome"
+      end
+    end
   end
 end

app/controllers/concerns/closable.rb

@@ -71,8 +71,12 @@ def confirm_respond
 
     case service.result
     when :ok
-      flash[:notice] = t("cases.confirm_respond.success")
-      redirect_to case_path(@case)
+      if @case.is_a?(Case::ICO::SAR)
+        redirect_to record_sar_complaint_outcome_case_ico_path(@case)
+      else
+        flash[:notice] = t("cases.confirm_respond.success")
+        redirect_to case_path(@case)
+      end
     when :late
       @team_collection = CaseTeamCollection.new(@case)
       render "cases/ico/late_team"
@@ -152,7 +156,6 @@ def respond
 
   def respond_and_close
     authorize @case
-
     @case.date_responded = nil
     set_permitted_events
     render "cases/closable/close"

app/controllers/concerns/ico_cases_params.rb

@@ -49,6 +49,13 @@ def record_late_team_ico_params
     end
   end
 
+  def record_complaint_outcome_params
+    params.require(:ico).permit(
+      :sar_complaint_outcome,
+      :other_sar_complaint_outcome_note,
+    )
+  end
+
   def process_new_linked_cases_for_params
     result = case @correspondence_type_key
              when "ico" then process_new_linked_cases_for_ico_params

app/decorators/case/ico/base_decorator.rb

@@ -1,16 +1,29 @@
 class Case::ICO::BaseDecorator < Case::BaseDecorator
+  include ActionView::Helpers::TagHelper
+  include ActionView::Context
+
   attr_accessor :related_case_number
 
   def formatted_date_ico_decision_received
     I18n.l(object.date_ico_decision_received, format: :default)
   end
 
   def pretty_ico_decision
+    decision = ""
+
     if object.ico_decision.present?
-      "#{object.ico_decision.capitalize} by ICO"
-    else
-      ""
+      decision += "#{object.ico_decision.capitalize} by ICO"
     end
+
+    if object.try(:sar_complaint_outcome).present?
+      decision += if object.sar_complaint_outcome == "other_outcome"
+                    content_tag(:div) { object.other_sar_complaint_outcome_note }
+                  else
+                    content_tag(:div) { I18n.t("helpers.label.ico.sar_complaint_outcome.#{object.sar_complaint_outcome}") }
+                  end
+    end
+
+    decision
   end
 
   def original_internal_deadline

app/models/case/ico/sar.rb

@@ -33,10 +33,29 @@
 #
 
 class Case::ICO::SAR < Case::ICO::Base
+  COMPLAINT_OUTCOMES = %w[
+    bau_ico_informed
+    bau_and_now_responded_as_sar
+    not_received_now_responded_as_sar
+    sar_processed_but_overdue
+    sar_incorrectly_processed_now_responded_as_sar
+    responded_to_sar_and_ico_informed
+    revised_sar_sent_exemptions_issue
+    revised_sar_sent_undisclosed_information
+    other_outcome
+  ].freeze
+
   def self.decorator_class
     Case::ICO::SARDecorator
   end
 
+  jsonb_accessor :properties,
+                 sar_complaint_outcome: :string,
+                 other_sar_complaint_outcome_note: :string
+
+  validates :sar_complaint_outcome, presence: true, inclusion: { in: COMPLAINT_OUTCOMES }, if: -> { prepared_for_recording_outcome? }
+  validates :other_sar_complaint_outcome_note, presence: true, if: -> { prepared_for_recording_outcome? && sar_complaint_outcome == "other_outcome" }
+
   def original_case_type = "SAR"
 
   def has_overturn?
@@ -46,4 +65,12 @@ def has_overturn?
   def reset_responding_assignment_flag
     responder_assignment.update(state: "pending")
   end
+
+  def prepare_for_recording_outcome
+    @preparing_for_recording_outcome = true
+  end
+
+  def prepared_for_recording_outcome?
+    @preparing_for_recording_outcome == true
+  end
 end

app/policies/case/ico/sar_policy.rb

@@ -12,4 +12,9 @@ def resolve
   def show?
     defer_to_existing_policy(Case::SARPolicy, :show?)
   end
+
+  def can_set_outcome?
+    clear_failed_checks
+    user.in?(self.case.approving_team_users)
+  end
 end

app/services/mark_response_as_sent_service.rb

@@ -23,6 +23,8 @@ def respond_to_ico
       @result = :error
     elsif @kase.responded_late?
       @result = :late
+    elsif @kase.is_a?(Case::ICO::SAR)
+      @result = :ok
     else
       @kase.respond(@user)
       @result = :ok

app/views/cases/closable/respond.html.slim

@@ -6,7 +6,6 @@
   br
   = @case.subject
 
-
 - content_for :sub_heading
   span.visually-hidden
     = t('common.case.header_case_number')

app/views/cases/ico/late_team.html.slim

@@ -7,9 +7,9 @@
       = 'Who was responsible for the late response?'
 
 - content_for :sub_heading
-span.visually-hidden
-  = t('common.case.header_case_number')
-= "#{@case.number} - #{@case.pretty_type}"
+  span.visually-hidden
+    = t('common.case.header_case_number')
+  = "#{@case.number} - #{@case.pretty_type}"
 
 = render partial: 'layouts/header'
 
@@ -23,5 +23,6 @@ div class="case-#{@case.type_abbreviation.downcase}"
 
     .grid-row
       .column-two-thirds
-        = f.submit 'Mark as responded', {class: 'button'}
-        = link_to "Return to case detail", case_path(@case.id), class: 'button-secondary button-left-spacing'
+        .button-holder
+          = f.submit t('common.case.respond'), {class: 'button'}
+          = link_to "Cancel", case_path(@case.id), class:'acts-like-button button-left-spacing'

app/views/cases/ico/sar/record_complaint_outcome.html.slim

@@ -0,0 +1,43 @@
+- content_for :page_title do
+  = t('page_title.ico_sar.complaint_outcome', case_number: @case.number)
+
+- content_for :heading
+  .grid-row
+    .column-two-thirds
+      = t('page_title.ico_sar.complaint_outcome')
+
+- content_for :sub_heading
+  span.visually-hidden
+    = t('common.case.header_case_number')
+  = "#{@case.number} - #{@case.pretty_type}"
+
+= link_to("Back", case_path(@case), class: 'govuk-back-link')
+
+span.visually-hidden
+  = t('common.case.header_case_number')
+  = @case.number
+
+= render partial: 'layouts/header'
+
+= GovukElementsErrorsHelper.error_summary @case,
+        "#{pluralize(@case.errors.count, t('common.error'))} #{ t('common.summary_error')}", ""
+
+.form-group
+  = form_for @case, as: :ico, url: record_sar_complaint_outcome_case_ico_path do |f|
+    = f.radio_button_fieldset :sar_complaint_outcome, legend_options: { class: 'visually-hidden' } do |fieldset|
+      - fieldset.radio_input(:bau_ico_informed)
+      - fieldset.radio_input(:bau_and_now_responded_as_sar)
+      - fieldset.radio_input(:not_received_now_responded_as_sar)
+      - fieldset.radio_input(:sar_processed_but_overdue)
+      - fieldset.radio_input(:sar_incorrectly_processed_now_responded_as_sar)
+      - fieldset.radio_input(:responded_to_sar_and_ico_informed)
+      - fieldset.radio_input(:revised_sar_sent_exemptions_issue)
+      - fieldset.radio_input(:revised_sar_sent_undisclosed_information)
+      - fieldset.radio_input(:other_outcome)
+        = f.text_area :other_sar_complaint_outcome_note, { rows: 4 }
+
+    .grid-row
+      .column-two-thirds
+        .button-holder
+          = f.submit t('common.case.respond'), { class: 'button' }
+          = link_to "Cancel", case_path(@case.id), class:'acts-like-button button-left-spacing'

app/views/cases/shared/_closed_case_details.html.slim

@@ -65,4 +65,4 @@ tbody.response-details
   - if case_details.ico? && case_details.ico_decision.present?
     tr.outcome
       th = t('common.case.outcome')
-      td = case_details.pretty_ico_decision
+      td = raw case_details.pretty_ico_decision

app/views/cases/shared/_date_responded_form.html.slim

@@ -7,12 +7,12 @@
 
 = form_for @case, as: :"#{@correspondence_type_key}", url: url do |f|
   .form-group
-    - unless @case.ico?
-      = f.gov_uk_date_field :date_responded, { legend_text: t('cases.shared.date_responded_form.close_date'),
+    - if @case.ico?
+      = f.gov_uk_date_field :date_ico_decision_received, { legend_text: t('cases.shared.date_responded_form.date_ico_decision_received_date'),
               form_hint_text: t('helpers.hint.shared.date_example'),
               today_button: {class: ''} }
     - else
-      = f.gov_uk_date_field :date_ico_decision_received, { legend_text: t('cases.shared.date_responded_form.date_ico_decision_received_date'),
+      = f.gov_uk_date_field :date_responded, { legend_text: t('cases.shared.date_responded_form.close_date'),
               form_hint_text: t('helpers.hint.shared.date_example'),
               today_button: {class: ''} }
 

config/locales/en.yml

@@ -456,6 +456,7 @@ en:
       <<: *case_policy
       can_close_case?: You are not authorised to close this case
       can_accept_or_reject_responder_assignment?: You are not allowed to accept or reject responder assignment
+      can_set_outcome?: You are not authorised
     case/foi/standard_policy:
       <<: *case_policy
     case/foi/compliance_review_policy:
@@ -814,6 +815,16 @@ en:
         original_case:
         received_date: Date received at MOJ
       ico:
+        sar_complaint_outcome:
+          bau_ico_informed: "Was originally treated as BAU, the ICO have been informed"
+          bau_and_now_responded_as_sar: "Was originally treated as BAU and we have now also responded as a SAR"
+          not_received_now_responded_as_sar: "No evidence of ever receiving the SAR. We have now responded to the SAR"
+          sar_processed_but_overdue: "SAR Timeliness breach - SAR processed correctly but is overdue"
+          sar_incorrectly_processed_now_responded_as_sar: "SAR Timeliness breach - SAR was not processed correctly (e.g. logged as a SAR). We have now provided a SAR response"
+          responded_to_sar_and_ico_informed: "We have already responded to the SAR, the ICO were informed"
+          revised_sar_sent_exemptions_issue: "Revised SAR response sent, as correct exemption(s) was not applied originally by the business area"
+          revised_sar_sent_undisclosed_information: "Revised SAR response sent, as some information should have been disclosed by the business area"
+          other_outcome: "Other (state why in notes section)"
         email: "Recipient email address"
         ico_decision:
           upheld: Upheld by ICO
@@ -1187,6 +1198,7 @@ en:
       original_internal_deadline: Original internal deadline
       original_date_responded: Original date response sent to ICO
       other_option_details: More details on other reason for outcome
+      mark_as_responded: Mark as responded
     case/ico:
       close: "Record ICO's decision"
       respond: Mark as sent to ICO

config/locales/page_titles.en.yml

@@ -99,3 +99,5 @@ en:
     partial_case_flags: Edit partial case information - %{case_number} - Track-a-query
     ico_foi:
       require_further_action: Require further action - %{case_number} - Track-a-query
+    ico_sar:
+      complaint_outcome: What was the outcome of the SAR complaint?

config/routes.rb

@@ -134,6 +134,8 @@
       patch "record_further_action", on: :member, to: "ico#confirm_record_further_action"
       get "require_further_action", on: :member, to: "ico#require_further_action"
       patch "require_further_action", on: :member, to: "ico#confirm_require_further_action"
+      get "record_sar_complaint_outcome", on: :member, to: "ico_sar#record_complaint_outcome"
+      patch "record_sar_complaint_outcome", on: :member, to: "ico_sar#confirm_record_complaint_outcome"
     end
 
     resources :overturned_ico_fois, only: [:create], controller: "overturned_ico_foi", as: :case_overturned_ico_fois do