Move tool checkout validations into the model

.rubocop.yml

@@ -103,16 +103,19 @@ Metrics/AbcSize:
     - "app/controllers/store/purchases_controller.rb"
     - "app/controllers/tool_inventory_controller.rb"
     - "app/controllers/tools_controller.rb"
+    - "app/controllers/tools/checkouts_controller.rb"
 Metrics/CyclomaticComplexity:
   Exclude:
     - "app/models/ability.rb"
     - "app/controllers/applets/ppe_distribution_controller.rb"
     - "app/controllers/organization_timeline_entries_controller.rb"
+    - "app/controllers/tools/checkouts_controller.rb"
 Metrics/PerceivedComplexity:
   Exclude:
     - "app/models/ability.rb"
     - "app/controllers/applets/ppe_distribution_controller.rb"
     - "app/controllers/organization_timeline_entries_controller.rb"
+    - "app/controllers/tools/checkouts_controller.rb"
 
 # load_step_* methods in ppe_distribution_controller return booleans as a side
 # effect of loading data — they are not pure predicates and should not end with ?.

app/controllers/applets/ppe_collection_controller.rb

@@ -17,8 +17,14 @@ def return_hardhat
     end
 
     @checkout = @hardhat.checkouts.current.first
-    @checkout.checked_in_at = Time.zone.now
-    @checkout.save!
+    @checkout.checkin
+    if @checkout.errors.any?
+      return(
+        redirect_to ppe_collection_path,
+                    alert: @checkout.errors.full_messages.join(', ')
+      )
+    end
+
     @hardhat.update(status: params[:status]) if params[:status].present?
 
     if @checkout.checked_in_at > Time.zone.local(2026, 4, 14)

app/controllers/applets/ppe_distribution_controller.rb

@@ -52,15 +52,15 @@ def load_step_one
   end
 
   def load_step_two
-    @participant = Participant.find(params[:participant_id])
+    @participant = Participant.find_by(id: params[:participant_id])
     return false if @participant.blank?
 
     session[:retry_hardhat] = nil
     true
   end
 
   def load_step_three
-    @participant = Participant.find(params[:participant_id])
+    @participant = Participant.find_by(id: params[:participant_id])
     return false if @participant.blank?
 
     if params[:hardhat_search].blank?
@@ -75,7 +75,7 @@ def load_step_three
       )
       return false
     end
-    @organization = Organization.find(params[:organization_id])
+    @organization = Organization.find_by(id: params[:organization_id])
     return false if @organization.blank?
 
     hh_type =
@@ -121,7 +121,7 @@ def load_step_three
 
   def step_three
     @checkout =
-      Checkout.create(
+      Checkout.new(
         tool: @hardhat,
         participant: @participant,
         organization: @organization,

app/controllers/tools/checkouts_controller.rb

@@ -30,28 +30,67 @@ def reset
   end
 
   def create
+    unless can? :create, Checkout
+      flash.alert = t('.unauthorized')
+      redirect_to checkout_tools_path
+      return
+    end
+
     return if params.dig(:checkout, :organization_id).blank?
 
-    @organization = Organization.find(params[:checkout][:organization_id])
-    if session[:tools].blank?
-      flash.alert = 'Add at least one tool to checkout.'
-      return
+    @organization =
+      Organization.find_by(id: params[:checkout][:organization_id])
+    participant = Participant.find_by(id: session[:borrower_id])
+    tool_ids = Array(session[:tools])
+
+    result =
+      Checkout.checkout_batch(
+        organization: @organization,
+        participant: participant,
+        tool_ids: tool_ids
+      )
+    session[:tools] = result[:remaining_ids]
+
+    if result[:failed].empty? && session[:tools].empty?
+      session[:borrower_id] = nil
+      flash.notice = "Tools checked out to #{participant&.name}"
+    else
+      failed_messages = result[:failed].flat_map { |c| c.errors.full_messages }
+      flash.alert =
+        (failed_messages.presence || ['Problem checking out tools']).join(', ')
     end
-    perform_tool_checkout
     redirect_to checkout_tools_path
   end
 
-  def update
+  def checkin
+    unless can? :update, Checkout
+      redirect_to checkout_tools_path, alert: t('.unauthorized')
+      return
+    end
+
     @tool = Tool.find_by(barcode: params[:barcode])
     if @tool.blank?
       redirect_to checkout_tools_path,
                   alert: "Tool #{params[:barcode]} does not exist."
-    else
-      checkin_tool
+      return
+    end
+
+    @checkout = @tool.checkouts.current.first
+    if @checkout.blank?
+      redirect_to checkout_tools_path,
+                  alert: "Tool #{params[:barcode]} was never checked out."
+      return
     end
-  rescue StandardError
+
+    @checkout.checkin
+    if @checkout.errors.any?
+      redirect_to checkout_tools_path,
+                  alert: @checkout.errors.full_messages.join(', ')
+      return
+    end
+
     redirect_to checkout_tools_path,
-                alert: "Tool #{params[:barcode]} was never checked out."
+                notice: "Tool #{params[:barcode]} successfully checked in."
   end
 
   private
@@ -76,36 +115,4 @@ def store_borrower_in_session
       flash.alert = "Andrew ID \"#{params[:participant_search]}\" not found."
     end
   end
-
-  def perform_tool_checkout
-    participant = Participant.find(session[:borrower_id])
-    bad_barcodes = []
-    session[:tools].each do |tool_id|
-      checkout_single_tool(tool_id, participant, bad_barcodes)
-    end
-    apply_tool_checkout_flash(participant, bad_barcodes)
-  end
-
-  def checkout_single_tool(tool_id, participant, bad_barcodes)
-    tool = Tool.find(tool_id)
-    if Checkout.create!(
-         organization: @organization,
-         participant:,
-         tool:,
-         checked_out_at: Time.zone.now
-       )
-      session[:tools] -= [tool_id]
-    else
-      bad_barcodes.append(tool.barcode)
-    end
-  end
-
-  def apply_tool_checkout_flash(participant, bad_barcodes)
-    if session[:tools].empty?
-      session[:borrower_id] = nil
-      flash.notice = "Tools checked out to #{participant.name}"
-    else
-      flash.alert = "Problem checking out tools #{bad_barcodes.join(', ')}"
-    end
-  end
 end

app/models/checkout.rb

@@ -10,6 +10,9 @@ class Checkout < ApplicationRecord
   validates :checked_out_at, presence: true
   validates_associated :tool, :organization, :participant
   validate :only_one_active_checkout_per_tool
+  validate :participant_signed_waiver, on: :create
+  validate :participant_belongs_to_org
+  validate :not_already_checked_in, on: :update
 
   belongs_to :participant, touch: true
   belongs_to :organization, touch: true
@@ -21,6 +24,12 @@ class Checkout < ApplicationRecord
   scope :active, -> { where(active: true) }
   scope :inactive, -> { where(active: false) }
 
+  def checkin
+    self.checked_in_at = Time.zone.now
+    save
+    self
+  end
+
   def only_one_active_checkout_per_tool
     unless Checkout
              .where(tool_id: tool_id, checked_in_at: nil)
@@ -31,4 +40,41 @@ def only_one_active_checkout_per_tool
 
     errors.add(:tool_id, 'already has an active checkout')
   end
+
+  def participant_signed_waiver
+    return if participant.blank? || participant.signed_waiver?
+
+    errors.add(:participant, 'has not signed the waiver')
+  end
+
+  def not_already_checked_in
+    return if checked_in_at_was.blank?
+
+    errors.add(:base, 'Checkout is already checked in')
+  end
+
+  def participant_belongs_to_org
+    return if organization_id.blank? || participant_id.blank?
+    if Membership.exists?(
+         organization_id: organization_id,
+         participant_id: participant_id
+       )
+      return
+    end
+
+    errors.add(:participant, 'does not belong to organization')
+  end
+
+  def self.checkout_batch(organization:, participant:, tool_ids:)
+    checked_out, failed =
+      tool_ids
+        .map { |id| attempt_checkout(id, organization, participant) }
+        .partition { |c| c.errors.none? }
+    { checked_out:, failed:, remaining_ids: failed.map(&:tool_id) }
+  end
+
+  def self.attempt_checkout(tool_id, organization, participant)
+    create(tool_id:, organization:, participant:, checked_out_at: Time.zone.now)
+  end
+  private_class_method :attempt_checkout
 end

config/locales/en.yml

@@ -149,6 +149,11 @@ en:
     update:
       notice: Updated Tool!
       alert: Could not update tool.
+    checkouts:
+      create:
+        unauthorized: Not authorized to check out tools.
+      checkin:
+        unauthorized: Not authorized to check in tools.
   faq:
     index:
       new: Add Question to FAQ