Prevent School#verified_at being changed once set

In preparation for creating a school in Profile API once it's verified.
Reducing the number of states a school can be in simplifies our
interactions with Profile API (we don't have to update/delete schools in
Profile API that were verified and then rejected, for example).

Author: chrisroos

app/models/school.rb

@@ -19,6 +19,7 @@ class School < ApplicationRecord
   validates :creator_agree_terms_and_conditions, presence: true, acceptance: true
   validates :rejected_at, absence: { if: proc { |school| school.verified? } }
   validates :verified_at, absence: { if: proc { |school| school.rejected? } }
+  validate :verified_at_cannot_be_changed
 
   before_validation :normalize_reference
 
@@ -47,4 +48,8 @@ def rejected?
   def normalize_reference
     self.reference = nil if reference.blank?
   end
+
+  def verified_at_cannot_be_changed
+    errors.add(:verified_at, 'cannot be changed after verification') if verified_at_was.present? && verified_at_changed?
+  end
 end

spec/models/school_spec.rb

@@ -189,6 +189,12 @@
       school.update(verified_at: Time.zone.now)
       expect(school.errors[:verified_at]).to include('must be blank')
     end
+
+    it "cannot change #verified_at once it's been set" do
+      school.update!(verified_at: Time.zone.now)
+      school.update(verified_at: nil)
+      expect(school.errors[:verified_at]).to include('cannot be changed after verification')
+    end
   end
 
   describe '#creator' do

spec/services/school_verification_service_spec.rb

@@ -83,12 +83,12 @@
       school.reload
     end
 
-    it 'sets verified_at to nil' do
-      expect(school.verified_at).to be_nil
+    it 'does not reset verified_at' do
+      expect(school.verified_at).to be_present
     end
 
-    it 'sets rejected_at to a date' do
-      expect(school.rejected_at).to be_a(ActiveSupport::TimeWithZone)
+    it 'does not set rejected_at' do
+      expect(school.rejected_at).to be_nil
     end
   end
 end