[prince-shakyaa]

Fixes #613

What was wrong

PUT /vendor/api/v1/invoices/{id} let a vendor change the amount, number, dates and attachments of an invoice in any status. An invoice approved for $100 could be changed to $45,000 and stay approved, and paid invoices could be changed after the money had gone out.

What changed

• finbot/apps/vendor/routes/api.py: the update endpoint now returns 409 if the invoice is approved or paid. The ownership check is unchanged and still runs first.
• finbot/static/js/vendor/invoice.js: the Edit button is hidden for approved and paid invoices, both in the table and in the invoice details sidecar.

Rejected invoices can still be edited, since nothing gets paid and the vendor can fix them and hit Re-process to get them reviewed again.

Testing

• Added tests/unit/vendor/test_invoice_edit_lock.py:
  • submitted, processing and rejected invoices can still be edited
  • approved and paid invoices return 409, and the amount and other fields stay the same
  • editing another vendor's invoice is still blocked
• The new lock tests fail without the fix and pass with it.
• Ran the full unit suite: everything passes except the 3 tests in tests/unit/agents/test_specialized_agents.py, which fail on main as well.
• Ran the app locally and went through the flow in the browser: created an invoice, edited it while submitted, edited it again after it was rejected and hit Re-process (both saved, re-process queued fine). Once it was approved or paid, the Edit button was gone, and sending the PUT directly returned 409 with the amount unchanged.

[prince-shakyaa]

Hi @saikishu @e2hln, this fixes #613.
Vendors could change the amount on an invoice after it was approved or paid, and the status stayed the same. Now approved and paid invoices can't be edited, and the Edit button is hidden for them.

I left rejected invoices editable on purpose so vendors can fix them and hit Re-process. If you'd rather lock those too, it's a one-line change and I can update it.

Tests are in tests/unit/vendor/test_invoice_edit_lock.py.
Let me know if you'd like anything changed.
Thank You.