From cf299fae2fcba288e9ee10937335aa4fc4c6f27d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vi=CC=81ctor=20Falco=CC=81n?= <victoor89@gmail.com>
Date: Thu, 18 Jun 2026 12:46:31 +0200
Subject: [PATCH] fix(integration-requests): freeze votes on not-doable
 requests

Voting on a not-doable request was already rejected, but a vote cast
before the request was marked not-doable could still be removed,
changing a frozen tally. Block removeVote for not-doable requests and
hide the unvote button accordingly.
---
 .../IntegrationRequestController.php          |  5 +++
 .../integration-requests-board.tsx            | 31 ++++++++++---------
 tests/Feature/IntegrationRequestTest.php      | 14 +++++++++
 3 files changed, 36 insertions(+), 14 deletions(-)

diff --git a/app/Http/Controllers/IntegrationRequestController.php b/app/Http/Controllers/IntegrationRequestController.php
index 14b88a12..3471a54c 100644
--- a/app/Http/Controllers/IntegrationRequestController.php
+++ b/app/Http/Controllers/IntegrationRequestController.php
@@ -79,6 +79,11 @@ class IntegrationRequestController extends Controller
     {
         $user = $request->user();
 
+        // Not-doable requests are frozen: their tally can no longer be touched.
+        if ($integrationRequest->status === IntegrationRequestStatus::NotDoable) {
+            abort(404);
+        }
+
         // Only votes cast this month can be undone, so the refund maps back to
         // the current quota while earlier months' tallies stay locked in.
         $vote = $integrationRequest->votes()
diff --git a/resources/js/components/integration-requests/integration-requests-board.tsx b/resources/js/components/integration-requests/integration-requests-board.tsx
index e117196f..81db4f11 100644
--- a/resources/js/components/integration-requests/integration-requests-board.tsx
+++ b/resources/js/components/integration-requests/integration-requests-board.tsx
@@ -138,7 +138,7 @@ export function IntegrationRequestsBoard({
     };
 
     const handleRemoveVote = async (item: IntegrationRequestItem) => {
-        if (busy || !item.can_unvote) {
+        if (busy || !item.can_unvote || item.status === 'not_doable') {
             return;
         }
 
@@ -273,19 +273,22 @@ export function IntegrationRequestsBoard({
                                     )}
                                 </div>
                                 <div className="flex items-center gap-1">
-                                    {item.can_unvote && (
-                                        <Button
-                                            variant="ghost"
-                                            size="sm"
-                                            disabled={busy}
-                                            onClick={() =>
-                                                handleRemoveVote(item)
-                                            }
-                                            aria-label={__('Remove one vote')}
-                                        >
-                                            <ChevronDown className="h-4 w-4" />
-                                        </Button>
-                                    )}
+                                    {item.can_unvote &&
+                                        item.status !== 'not_doable' && (
+                                            <Button
+                                                variant="ghost"
+                                                size="sm"
+                                                disabled={busy}
+                                                onClick={() =>
+                                                    handleRemoveVote(item)
+                                                }
+                                                aria-label={__(
+                                                    'Remove one vote',
+                                                )}
+                                            >
+                                                <ChevronDown className="h-4 w-4" />
+                                            </Button>
+                                        )}
                                     <Button
                                         variant={
                                             item.has_voted
diff --git a/tests/Feature/IntegrationRequestTest.php b/tests/Feature/IntegrationRequestTest.php
index 467741dc..1fd1ed29 100644
--- a/tests/Feature/IntegrationRequestTest.php
+++ b/tests/Feature/IntegrationRequestTest.php
@@ -323,6 +323,20 @@ test('nobody can vote on a not doable request', function () {
         ->assertNotFound();
 });
 
+test('a vote on a request later marked not doable cannot be removed', function () {
+    $user = User::factory()->create();
+    $request = IntegrationRequest::factory()->approved()->create();
+    $request->votes()->create(['user_id' => $user->id]);
+
+    $request->update(['status' => IntegrationRequestStatus::NotDoable]);
+
+    $this->actingAs($user)
+        ->deleteJson("/integration-requests/{$request->id}/vote")
+        ->assertNotFound();
+
+    expect($request->votes()->count())->toBe(1);
+});
+
 test('the review command marks a request as not doable with a comment', function () {
     $request = IntegrationRequest::factory()->create(['name' => 'Hard Bank']);