Allow support users to create merge request for any organisation

app/controllers/merge_requests_controller.rb

@@ -27,7 +27,7 @@ class MergeRequestsController < ApplicationController
   end
 
   def remove_merging_organsiation
-    MergeRequestOrganisation.find_by(merge_request_organisation_params).destroy
+    MergeRequestOrganisation.find_by(merge_request_organisation_params).destroy!
     @merge_request.reload
     @answer_options = organisations_answer_options
     @merging_organisations_list = [@merge_request.requesting_organisation] + @merge_request.merging_organisations
@@ -46,9 +46,12 @@ private
   end
 
   def merge_request_params
-    merge_params = params.fetch(:merge_request, {}).permit(:requesting_organisation)
+    merge_params = params.fetch(:merge_request, {}).permit(:requesting_organisation_id)
+
+    if current_user.data_coordinator? || current_user.data_provider?
+      merge_params[:requesting_organisation_id] = current_user.organisation.id
+    end
 
-    merge_params[:requesting_organisation] = current_user.organisation
     merge_params
   end
 

app/views/organisations/merge_request.html.erb

@@ -42,6 +42,7 @@
     <%= govuk_warning_text text: "You will not be able to submit your request without the above information. Do not start the form until you have obtained all of the information. " %>
 
     <%= form_for @merge_request, url: merge_requests_path do |f| %>
+      <%= f.hidden_field :requesting_organisation_id, value: @organisation.id %>
       <%= f.submit "Start now", class: "govuk-button govuk-button--start" %>
     <% end %>
   </div>

spec/requests/merge_requests_controller_spec.rb

@@ -6,6 +6,7 @@ RSpec.describe MergeRequestsController, type: :request do
   let(:headers) { { "Accept" => "text/html" } }
   let(:page) { Capybara::Node::Simple.new(response.body) }
   let(:user) { FactoryBot.create(:user, :data_coordinator) }
+  let(:support_user) { FactoryBot.create(:user, :support, organisation:) }
   let(:merge_request) { MergeRequest.create!(requesting_organisation: organisation) }
 
   context "when user is signed in with a data coordinator user" do
@@ -14,9 +15,11 @@ RSpec.describe MergeRequestsController, type: :request do
     end
 
     describe "#organisations" do
+      let(:params) { {} }
+
       before do
         organisation.update!(name: "Test Org")
-        post "/merge-request", headers:, params: {}
+        post "/merge-request", headers:, params:
       end
 
       it "creates merge request with requesting organisation" do
@@ -25,6 +28,16 @@ RSpec.describe MergeRequestsController, type: :request do
         expect(page).to have_content("Test Org")
         expect(page).not_to have_link("Remove")
       end
+
+      context "when passing a different requesting organisation id" do
+        let(:params) { { merge_request: { requesting_organisation_id: other_organisation.id } } }
+
+        it "creates merge request with current user organisation" do
+          follow_redirect!
+          expect(MergeRequest.count).to eq(1)
+          expect(MergeRequest.first.requesting_organisation_id).to eq(organisation.id)
+        end
+      end
     end
 
     describe "#update_organisations" do
@@ -110,4 +123,26 @@ RSpec.describe MergeRequestsController, type: :request do
       end
     end
   end
+
+  context "when user is signed in as a support user" do
+    before do
+      allow(support_user).to receive(:need_two_factor_authentication?).and_return(false)
+      sign_in support_user
+    end
+
+    describe "#organisations" do
+      let(:params) { { merge_request: { requesting_organisation_id: other_organisation.id } } }
+
+      before do
+        organisation.update!(name: "Test Org")
+        post "/merge-request", headers:, params:
+      end
+
+      it "creates merge request with requesting organisation" do
+        follow_redirect!
+        expect(MergeRequest.count).to eq(1)
+        expect(MergeRequest.first.requesting_organisation_id).to eq(other_organisation.id)
+      end
+    end
+  end
 end