JASPER-863: Signing and Digital Workflow: (Applications) Provide a way for judge to handle family desk orders by filling and signing instead of uploading a document with terms.

[ronaldo-macapobre]

Pull Request for JIRA Ticket: JASPER-863

Issue ticket number and link

https://jira.justice.gov.bc.ca/browse/JASPER-863

Description

Frontend changes updates how Desk Orders are reviewed and ensures the correct data is passed through. Backend changes mirrors the frontend validation logic and adds antivirus scanning of uploaded documents before they're sent to CSO.

Type of change

• New feature (non-breaking change which adds functionality)

How Has This Been Tested?

• Local

Checklist:

• My code follows the style guidelines of this project
• I have performed a self-review of my code
• I have commented my code, particularly in hard-to-understand areas
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes
• Any dependent changes have been merged and published in downstream modules

[Copilot]

Pull request overview

This PR updates the desk-order review/submission workflow to support “fill & sign” submission (instead of requiring an uploaded terms document), and adds backend-side validation plus antivirus scanning for uploaded/review documents.

Changes:

• Frontend: adjust Family Desk Order review modal logic to conditionally require an upload only when the order is not signable, and treat OrderMade as a submitted outcome in UI messaging.
• Frontend: export/flatten signed PDFs for both Approved and OrderMade when no supporting document is provided.
• Backend: add OrderReviewDto validator, add antivirus scanning for reviewed documents, and tighten desk-order status/data validation.

Reviewed changes

Copilot reviewed 12 out of 12 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
web/tests/components/documents/strategies/OrderPDFStrategy.test.ts	Updates snackbar expectations to “submitted” messaging.
web/tests/components/documents/ReviewModal.test.ts	Updates/extends ReviewModal coverage for Family Desk Order submission paths.
web/src/components/documents/strategies/OrderPDFStrategy.ts	Treats OrderMade like Approved for submitted snackbar messaging.
web/src/components/documents/ReviewModal.vue	Updates upload gating and signed payload logic for Family Desk Orders.
web/src/components/documents/FileViewer.vue	Flattens/export PDFs for both Approved and OrderMade when no supporting doc is present.
tests/api/Validators/Order/OrderReviewDtoValidatorTests.cs	Adds unit tests for new review DTO validator rules (incl. null payload).
tests/api/Services/OrderServiceTests.cs	Updates service tests for antivirus scanning and desk-order submission semantics.
tests/api/Controllers/OrdersControllerTests.cs	Updates controller tests for new review DTO validation behavior.
models/Order/ReferralDto.cs	Adds computed CourtListTypeDesc to support desk-order detection.
api/Validators/Order/OrderReviewDtoValidator.cs	Introduces FluentValidation validator for review document payloads.
api/Services/OrderService.cs	Adds antivirus scanning and desk-order validation logic during review/submission.
api/Controllers/OrdersController.cs	Wires review DTO validator into the ReviewOrder endpoint.

Suppressed comments (1)

web/tests/components/documents/ReviewModal.test.ts:159

• This test name says "can be approved" but the setup uses canApprove: true and asserts the upload is hidden. Consider renaming to reflect the "signed/submit-ready" state to avoid confusion with the previous test.

    it('should not render the DocumentUpload component when it can be approved (submitted)', () => {

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 12 out of 12 changed files in this pull request and generated no new comments.

Suppressed comments (3)

Previously missed (1) — in code that hasn't changed since the last review.

api/Services/OrderService.cs:262

• Desk order detection is currently based on CourtListTypeDesc (a derived display string). Using the description string for business logic is brittle (changes to Describe()/localization/casing would change behavior). Prefer checking CourtListTypeCd against the known desk-order codes.

This issue also appears on line 497 of the same file.

        if (orderDto.OrderRequest?.Referral?.CourtListTypeDesc == CourtListTypeDescriptor.DESK_ORDER_DESCRIPTION)
        {
            // Desk Orders should only have a status of Order Made
            if (orderDto.Status != OrderStatus.OrderMade)
            {
                return OperationResult.Failure("Incorrect status for submitting a desk order.");
            }

api/Services/OrderService.cs:505

• MapToOrderAction uses CourtListTypeDesc (derived display string) to decide whether desk-order submission rules apply. This is fragile for business logic; prefer checking CourtListTypeCd against the explicit desk-order constants.

        if (orderDto.OrderRequest?.Referral?.CourtListTypeDesc == CourtListTypeDescriptor.DESK_ORDER_DESCRIPTION)
        {
            if (!IsDeskOrderReadyForSubmission(orderDto))
            {
                return null;
            }

            actionDto = PopulateDeskOrderDetails(orderDto, actionDto);
        }

api/Controllers/OrdersController.cs:123

• ReviewOrder returns HTTP 500 for expected client/business validation failures coming back from IOrderService.ReviewOrder (e.g., judge not assigned, incorrect status for desk orders, antivirus scan failure). These are not server errors and should be mapped to a 4xx (400/403/422) so clients can react correctly.

        var result = await _orderService.ReviewOrder(id, orderReview);

        if (!result.Succeeded)
        {
            return result.Errors.Any(e => e.Contains("not found"))
                ? NotFound(new { error = result.Errors })
                : StatusCode(StatusCodes.Status500InternalServerError, new { error = result.Errors });
        }

[devinleighsmith]

Is AC1 in met by this PR?

AC1: When processing a family desk order, if the judge has signed the PDF, selecting the button to process the order will provide them with the approve/awaiting further documentation/reject screen instead of the “upload” option. If the judge submits, JASPER will return the PDF as changed by the judge along with the status and any comments.

[devinleighsmith]

Can we implement a CourtListTypeDescriptor.IsDeskOrder(code) similar to what exists on the frontend? we used to check for PSM/PFM explicitly and this seems lower confidence.

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[ronaldo-macapobre]

Is AC1 in met by this PR?

AC1: When processing a family desk order, if the judge has signed the PDF, selecting the button to process the order will provide them with the approve/awaiting further documentation/reject screen instead of the “upload” option. If the judge submits, JASPER will return the PDF as changed by the judge along with the status and any comments.

AC1 is now outdated due to the changes from JASPER-865. Basically, there should only one Submit button when processing a Desk Order. Clicking this button would set the status as OrderMade. When an application is family, a signature or an uploaded word document is required to submit. If Small Claims desk order, it requires a signature.