invoices: cancel with stamped PDF, superuser-only hiding

An invoice issued by mistake could only be left pending or marked paid.
Add cancel (with an optional reason) and reinstate. Cancelling renders a
third PDF variant with a diagonal CANCELLED stamp and the date/reason,
and it becomes the current one, so the client's link and download show
the invoice as void. Cancelled wins over paid in the status, and marking
a cancelled invoice paid is refused.

Superusers can also hide an invoice: it disappears from the admin list,
dashboard and invoice pages for every other user, while the client's
public link keeps working.

Assisted-by: Claude:opus-5

test/invoice_cancel_test.rb

@@ -0,0 +1,84 @@
+require_relative 'test_helper'
+
+class InvoiceCancelTest < Minitest::Test
+  include Rack::Test::Methods
+  include AdminLogin
+
+  def app
+    AsxpioWeb
+  end
+
+  def setup
+    skip 'TEST_DATABASE_URL not set' unless TestDb.available?
+    TestDb.clean!
+    TestDb.clean_users!
+    @inv = Invoice.build(client_name: 'ACME', client_email: 'b@example.com', currency: 'EUR', gel_rate: '3.05',
+                         items: [{ 'description' => 'work', 'qty' => '1', 'unit_price' => '100' }])
+    @inv.pdf_key = "invoices/#{@inv.number}-#{@inv.uuid}.pdf"
+    @inv.save_changes
+  end
+
+  def token
+    get '/admin'
+    last_response.body[/name="authenticity_token" value="([^"]+)"/, 1]
+  end
+
+  def test_cancel_marks_status_and_renders_cancelled_pdf
+    admin_login!
+    post "/admin/invoices/#{@inv.uuid}/cancel", { authenticity_token: token, reason: 'Duplicate of INV-1' }
+    assert_equal 302, last_response.status
+    @inv.refresh
+    assert @inv.cancelled?
+    assert_equal 'cancelled', @inv.status
+    assert_equal 'Duplicate of INV-1', @inv.cancel_reason
+    assert_match(/-cancelled\.pdf\z/, @inv.current_pdf_key)
+    get "/i/#{@inv.uuid}"
+    assert_includes last_response.body, 'badge-cancelled'
+    assert_includes last_response.body, 'not payable'
+
+    post "/admin/invoices/#{@inv.uuid}/paid", { authenticity_token: token }
+    assert_equal 422, last_response.status
+
+    post "/admin/invoices/#{@inv.uuid}/reinstate", { authenticity_token: token }
+    refute @inv.refresh.cancelled?
+    assert_equal 'pending', @inv.status
+  end
+
+  def test_cancelled_pdf_renders
+    @inv.cancelled_at = Time.now.utc
+    @inv.cancel_reason = 'wrong client'
+    pdf = InvoicePdf.render(@inv, status: 'cancelled')
+    assert pdf.start_with?('%PDF')
+  end
+
+  def test_hidden_invoice_only_for_superusers
+    admin_login!
+    post "/admin/invoices/#{@inv.uuid}/hide", { authenticity_token: token }
+    assert @inv.refresh.hidden
+    get '/admin/invoices'
+    assert_includes last_response.body, 'badge-hidden'
+
+    clear_cookies
+    @admin_logged_in = false
+    u = User.create(username: 'clerk', password: 'clerk-password-1')
+    UserPermission.create(user_id: u.id, area: 'invoices', can_read: true, can_write: true)
+    admin_login!(username: 'clerk', password: 'clerk-password-1')
+    get '/admin/invoices'
+    refute_includes last_response.body, @inv.number
+    get "/admin/invoices/#{@inv.uuid}"
+    assert_equal 404, last_response.status
+    post "/admin/invoices/#{@inv.uuid}/hide", { authenticity_token: token }
+    assert_equal 403, last_response.status
+    get '/admin'
+    refute_includes last_response.body, @inv.number
+    get "/i/#{@inv.uuid}"
+    assert last_response.ok?                      # client link unaffected
+  end
+
+  def test_dashboard_ignores_cancelled_for_outstanding
+    @inv.update(cancelled_at: Time.now.utc)
+    admin_login!
+    get '/admin'
+    assert_match %r{<b>0</b><span>unpaid</span>}, last_response.body
+  end
+end