fix: guard against double-approve/reject on resolved approvals

[aramirez087]

Summary

• Resolved approvals (approved / rejected) are now immutable — any attempt to change their status returns 409 Conflict
• Prevents a client retry or race condition from re-triggering approval side-effects (e.g. a duplicate X API post)
• The guard fires before the existing pending-conflict check, making resolved approvals a hard boundary

Bug

PATCH /boards/{id}/approvals/{id} accepted status changes on already-resolved approvals. Calling approve on an already-approved item silently returned 200 and updated resolved_at, which could trigger duplicate external actions downstream.

Found by: automated integration tests (task 3.4 — route handler coverage).

Change

backend/app/api/approvals.py — 11-line guard added before the existing pending-conflict check:

if prior_status in ("approved", "rejected"):
    raise HTTPException(409, detail={
        "message": f"Approval is already {prior_status}.",
        "approval_id": ...,
        "current_status": prior_status,
        "requested_status": target_status,
    })

backend/tests/test_approvals_pending_conflicts.py — 3 new tests + 1 updated:

• test_update_approval_rejects_double_approve
• test_update_approval_rejects_double_reject
• test_update_approval_rejects_approving_rejected
• test_update_approval_rejects_reopening_resolved_to_pending (updated from prior test)

Test plan

• make backend-test — 472 passed, 0 failed
• Verify existing approval workflows still function (pending → approved, pending → rejected)
• Verify 409 response in approval UI when attempting to re-approve

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR makes resolved approvals (status approved/rejected) immutable by rejecting any subsequent status updates with a 409 Conflict, and updates the test suite to cover the new immutability behavior.

Changes:

• Add an early 409 guard in update_approval to block status updates once an approval is resolved.
• Update/expand approval conflict tests to assert 409 responses for double-approve/double-reject and attempts to change resolved approvals.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
backend/app/api/approvals.py	Adds immutability guard for resolved approvals inside update_approval.
backend/tests/test_approvals_pending_conflicts.py	Reworks and adds tests validating 409 behavior when attempting to update resolved approvals.

[Copilot]

Pull request overview

This PR changes the approval update behavior to treat resolved approvals (approved/rejected) as immutable with respect to status changes, and updates the backend test suite to cover the new 409-conflict semantics for repeated or invalid status updates.

Changes:

• Add a 409 guard in update_approval preventing any status mutation once an approval is resolved.
• Replace/extend approval update tests to assert 409 responses for double-approve, double-reject, approving a rejected approval, and reopening a resolved approval to pending.
• Update expected error payload shape in tests (message, current_status, requested_status).

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.

File	Description
backend/app/api/approvals.py	Enforces “resolved approvals are immutable” by rejecting status updates for approved/rejected approvals with a 409 detail payload.
backend/tests/test_approvals_pending_conflicts.py	Adds/adjusts asyncio tests to validate the new 409 behavior and error details for various resolved-status update attempts.