refactor: apply review changes to joinrequest

lib/membership/join_request/changes/confirm_request.ex

@@ -3,15 +3,23 @@ defmodule Mv.Membership.JoinRequest.Changes.ConfirmRequest do
   Sets the join request to submitted (confirmation link clicked).
 
   Used by the confirm action after the user clicks the confirmation link.
-  Token hash is kept so that a second click (idempotent) can still find the record
-  and return success without changing it.
+  Only applies when the current status is `:pending_confirmation`, so that
+  direct calls to the confirm action are idempotent and never overwrite
+  :submitted, :approved, or :rejected. Token hash is kept so a second click
+  can still find the record and return success without changing it.
   """
   use Ash.Resource.Change
 
   @spec change(Ash.Changeset.t(), keyword(), Ash.Resource.Change.context()) :: Ash.Changeset.t()
   def change(changeset, _opts, _context) do
-    changeset
-    |> Ash.Changeset.force_change_attribute(:status, :submitted)
-    |> Ash.Changeset.force_change_attribute(:submitted_at, DateTime.utc_now())
+    current_status = Ash.Changeset.get_data(changeset, :status)
+
+    if current_status == :pending_confirmation do
+      changeset
+      |> Ash.Changeset.force_change_attribute(:status, :submitted)
+      |> Ash.Changeset.force_change_attribute(:submitted_at, DateTime.utc_now())
+    else
+      changeset
+    end
   end
 end

lib/membership/join_request/changes/set_confirmation_token.ex

@@ -2,11 +2,15 @@ defmodule Mv.Membership.JoinRequest.Changes.SetConfirmationToken do
   @moduledoc """
   Hashes the confirmation token and sets expiry for the join request (submit flow).
 
+  Uses `JoinRequest.hash_confirmation_token/1` so hashing logic lives in one place.
+
   Reads the :confirmation_token argument, stores only its SHA256 hash and sets
   confirmation_token_expires_at (e.g. 24h). Raw token is never persisted.
   """
   use Ash.Resource.Change
 
+  alias Mv.Membership.JoinRequest
+
   @confirmation_validity_hours 24
 
   @spec change(Ash.Changeset.t(), keyword(), Ash.Resource.Change.context()) :: Ash.Changeset.t()
@@ -14,7 +18,7 @@ defmodule Mv.Membership.JoinRequest.Changes.SetConfirmationToken do
     token = Ash.Changeset.get_argument(changeset, :confirmation_token)
 
     if is_binary(token) and token != "" do
-      hash = token_hash(token)
+      hash = JoinRequest.hash_confirmation_token(token)
       expires_at = DateTime.utc_now() |> DateTime.add(@confirmation_validity_hours, :hour)
 
       changeset
@@ -25,8 +29,4 @@ defmodule Mv.Membership.JoinRequest.Changes.SetConfirmationToken do
       changeset
     end
   end
-
-  defp token_hash(token) do
-    :crypto.hash(:sha256, token) |> Base.encode16(case: :lower)
-  end
 end