DTR-6017: F7 Update subcontractor

app/uk/gov/hmrc/formpproxy/cis/controllers/SubcontractorController.scala

@@ -24,7 +24,7 @@ import uk.gov.hmrc.formpproxy.cis.models.GetSubcontractorList
 import uk.gov.hmrc.formpproxy.cis.services.SubcontractorService
 import uk.gov.hmrc.play.bootstrap.backend.controller.BackendController
 import uk.gov.hmrc.formpproxy.cis.models.response.GetSubcontractorResponse
-import uk.gov.hmrc.formpproxy.cis.models.requests.{CreateAndUpdateSubcontractorRequest, DeleteSubcontractorRequest}
+import uk.gov.hmrc.formpproxy.cis.models.requests.{CreateAndUpdateSubcontractorRequest, DeleteSubcontractorRequest, UpdateSubcontractorRequest}
 
 import javax.inject.Inject
 import scala.concurrent.{ExecutionContext, Future}
@@ -111,4 +111,30 @@ class SubcontractorController @Inject() (
           InternalServerError(Json.obj("message" -> "Unexpected error"))
         }
     }
+
+  def updateSubcontractor: Action[JsValue] =
+    authorise.async(parse.json) { implicit request =>
+      request.body
+        .validate[UpdateSubcontractorRequest]
+        .fold(
+          errs =>
+            Future.successful(
+              BadRequest(
+                Json.obj(
+                  "message" -> "Invalid payload",
+                  "errors"  -> JsError.toJson(errs)
+                )
+              )
+            ),
+          body =>
+            service
+              .updateSubcontractor(body)
+              .map(response => Ok(Json.toJson(response)))
+              .recover { case NonFatal(e) =>
+                logger.error("[updateSubcontractor] failed", e)
+                InternalServerError(Json.obj("message" -> "Unexpected error"))
+              }
+        )
+    }
+
 }

app/uk/gov/hmrc/formpproxy/cis/models/requests/UpdateSubcontractorRequest.scala

@@ -0,0 +1,30 @@
+/*
+ * Copyright 2026 HM Revenue & Customs
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package uk.gov.hmrc.formpproxy.cis.models.requests
+
+import play.api.libs.json.{Json, OFormat}
+import uk.gov.hmrc.formpproxy.cis.models.Subcontractor
+
+final case class UpdateSubcontractorRequest(
+  cisId: String,
+  subcontractor: Subcontractor
+)
+
+object UpdateSubcontractorRequest {
+  given format: OFormat[UpdateSubcontractorRequest] =
+    Json.format[UpdateSubcontractorRequest]
+}

app/uk/gov/hmrc/formpproxy/cis/models/response/UpdateSubcontractorResponse.scala

@@ -0,0 +1,28 @@
+/*
+ * Copyright 2026 HM Revenue & Customs
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package uk.gov.hmrc.formpproxy.cis.models.response
+
+import play.api.libs.json.{Json, OFormat}
+
+final case class UpdateSubcontractorResponse(
+  version: Int
+)
+
+object UpdateSubcontractorResponse {
+  given format: OFormat[UpdateSubcontractorResponse] =
+    Json.format[UpdateSubcontractorResponse]
+}

app/uk/gov/hmrc/formpproxy/cis/repositories/CisFormpRepository.scala

@@ -100,6 +100,8 @@ trait CisMonthlyReturnSource {
   def getSubmittedVerifications(req: GetSubmittedVerificationsRequest): Future[GetSubmittedVerificationsResponse]
 
   def getSubcontractor(cisId: String, subbieResourceRef: Long): Future[GetSubcontractorResponse]
+
+  def updateSubcontractor(request: UpdateSubcontractorRequest): Future[UpdateSubcontractorResponse]
 }
 
 private final case class SchemeRow(schemeId: Long, version: Option[Int], email: Option[String])
@@ -1953,4 +1955,170 @@ class CisFormpRepository @Inject() (@NamedDatabase("cis") db: Database)(implicit
       }
     }
 
+  override def updateSubcontractor(
+    request: UpdateSubcontractorRequest
+  ): Future[UpdateSubcontractorResponse] =
+    Future {
+      logger.info(
+        s"[CIS] updateSubcontractor(cisId=${request.cisId}, subbieResourceRef=${request.subcontractor.subbieResourceRef})"
+      )
+
+      db.withConnection { conn =>
+        val scheme =
+          loadScheme(conn, request.cisId)
+
+        val subbieResourceRef =
+          request.subcontractor.subbieResourceRef.getOrElse(
+            throw new IllegalArgumentException("subbieResourceRef is required")
+          )
+
+        val existingSubcontractor =
+          getExistingSubcontractorForUpdate(
+            conn = conn,
+            cisId = request.cisId,
+            subbieResourceRef = subbieResourceRef
+          )
+
+        val mergedSubcontractor =
+          mergeSubcontractorForUpdate(
+            existing = existingSubcontractor,
+            incoming = request.subcontractor
+          )
+
+        val updatedSubcontractorVersion =
+          callUpdateExistingSubcontractor(
+            conn = conn,
+            schemeId = scheme.schemeId,
+            subbieResourceRef = subbieResourceRef,
+            subcontractor = mergedSubcontractor
+          )
+
+        callUpdateSchemeVersion(
+          conn,
+          request.cisId,
+          scheme.version.getOrElse(0)
+        )
+
+        UpdateSubcontractorResponse(
+          version = updatedSubcontractorVersion
+        )
+      }
+    }
+
+  private def callUpdateExistingSubcontractor(
+    conn: Connection,
+    schemeId: Long,
+    subbieResourceRef: Long,
+    subcontractor: Subcontractor
+  ): Int =
+    withCall(conn, CallUpdateSubcontractor) { cs =>
+      cs.setLong(1, schemeId)
+      cs.setLong(2, subbieResourceRef)
+
+      cs.setOptionalString(3, subcontractor.utr)
+      cs.setOptionalInt(4, subcontractor.pageVisited)
+      cs.setOptionalString(5, subcontractor.partnerUtr)
+      cs.setOptionalString(6, subcontractor.crn)
+
+      cs.setOptionalString(7, subcontractor.firstName)
+      cs.setOptionalString(8, subcontractor.nino)
+      cs.setOptionalString(9, subcontractor.secondName)
+      cs.setOptionalString(10, subcontractor.surname)
+
+      cs.setOptionalString(11, subcontractor.partnershipTradingName)
+      cs.setOptionalString(12, subcontractor.tradingName)
+
+      cs.setOptionalString(13, subcontractor.addressLine1)
+      cs.setOptionalString(14, subcontractor.addressLine2)
+      cs.setOptionalString(15, subcontractor.addressLine3)
+      cs.setOptionalString(16, subcontractor.addressLine4)
+
+      cs.setOptionalString(17, subcontractor.country)
+      cs.setOptionalString(18, subcontractor.postcode)
+
+      cs.setOptionalString(19, subcontractor.emailAddress)
+      cs.setOptionalString(20, subcontractor.phoneNumber)
+      cs.setOptionalString(21, subcontractor.mobilePhoneNumber)
+      cs.setOptionalString(22, subcontractor.worksReferenceNumber)
+
+      cs.setOptionalString(23, subcontractor.matched)
+      cs.setOptionalString(24, subcontractor.autoVerified)
+      cs.setOptionalString(25, subcontractor.verified)
+      cs.setOptionalString(26, subcontractor.verificationNumber)
+      cs.setOptionalString(27, subcontractor.taxTreatment)
+      cs.setOptionalString(28, subcontractor.updatedTaxTreatment)
+      cs.setOptionalTimestamp(29, subcontractor.verificationDate)
+
+      cs.setOptionalInt(30, subcontractor.version)
+      cs.registerOutParameter(30, Types.INTEGER)
+
+      cs.execute()
+
+      cs.getInt(30)
+    }
+
+  private def getExistingSubcontractorForUpdate(
+    conn: Connection,
+    cisId: String,
+    subbieResourceRef: Long
+  ): Subcontractor =
+    withCall(conn, CallGetSubcontractor) { cs =>
+      cs.setString(1, cisId)
+      cs.setLong(2, subbieResourceRef)
+
+      cs.registerOutParameter(3, OracleTypes.CURSOR)
+      cs.registerOutParameter(4, OracleTypes.CURSOR)
+      cs.registerOutParameter(5, OracleTypes.CURSOR)
+
+      cs.execute()
+
+      discardCursor(cs, 3)
+
+      val subcontractor =
+        withCursor(cs, 4)(collectSubcontractors).headOption.getOrElse(
+          throw new RuntimeException(
+            s"No subcontractor found for cisId=$cisId and subbieResourceRef=$subbieResourceRef"
+          )
+        )
+
+      discardCursor(cs, 5)
+
+      subcontractor
+    }
+
+  private def mergeSubcontractorForUpdate(existing: Subcontractor, incoming: Subcontractor): Subcontractor =
+    existing.copy(
+      utr = incoming.utr.orElse(existing.utr),
+      pageVisited = incoming.pageVisited.orElse(existing.pageVisited),
+      partnerUtr = incoming.partnerUtr.orElse(existing.partnerUtr),
+      crn = incoming.crn.orElse(existing.crn),
+      firstName = incoming.firstName.orElse(existing.firstName),
+      nino = incoming.nino.orElse(existing.nino),
+      secondName = incoming.secondName.orElse(existing.secondName),
+      surname = incoming.surname.orElse(existing.surname),
+      partnershipTradingName = incoming.partnershipTradingName.orElse(existing.partnershipTradingName),
+      tradingName = incoming.tradingName.orElse(existing.tradingName),
+      subcontractorType = incoming.subcontractorType.orElse(existing.subcontractorType),
+      addressLine1 = incoming.addressLine1.orElse(existing.addressLine1),
+      addressLine2 = incoming.addressLine2.orElse(existing.addressLine2),
+      addressLine3 = incoming.addressLine3.orElse(existing.addressLine3),
+      addressLine4 = incoming.addressLine4.orElse(existing.addressLine4),
+      country = incoming.country.orElse(existing.country),
+      postcode = incoming.postcode.orElse(existing.postcode),
+      emailAddress = incoming.emailAddress.orElse(existing.emailAddress),
+      phoneNumber = incoming.phoneNumber.orElse(existing.phoneNumber),
+      mobilePhoneNumber = incoming.mobilePhoneNumber.orElse(existing.mobilePhoneNumber),
+      worksReferenceNumber = incoming.worksReferenceNumber.orElse(existing.worksReferenceNumber),
+      matched = incoming.matched.orElse(existing.matched),
+      autoVerified = incoming.autoVerified.orElse(existing.autoVerified),
+      verified = incoming.verified.orElse(existing.verified),
+      verificationNumber = incoming.verificationNumber.orElse(existing.verificationNumber),
+      taxTreatment = incoming.taxTreatment.orElse(existing.taxTreatment),
+      verificationDate = incoming.verificationDate.orElse(existing.verificationDate),
+      updatedTaxTreatment = incoming.updatedTaxTreatment.orElse(existing.updatedTaxTreatment),
+      version = incoming.version.orElse(existing.version),
+      lastMonthlyReturnDate = incoming.lastMonthlyReturnDate.orElse(existing.lastMonthlyReturnDate),
+      pendingVerifications = incoming.pendingVerifications.orElse(existing.pendingVerifications)
+    )
+
 }

app/uk/gov/hmrc/formpproxy/cis/services/SubcontractorService.scala

@@ -22,6 +22,8 @@ import uk.gov.hmrc.formpproxy.cis.models.response.{GetSubcontractorForDeleteResp
 import uk.gov.hmrc.formpproxy.cis.repositories.CisMonthlyReturnSource
 import uk.gov.hmrc.formpproxy.cis.models.CreateAndUpdateSubcontractorDatabaseRecord
 import uk.gov.hmrc.formpproxy.cis.models.response.GetSubcontractorResponse
+import uk.gov.hmrc.formpproxy.cis.models.requests.UpdateSubcontractorRequest
+import uk.gov.hmrc.formpproxy.cis.models.response.UpdateSubcontractorResponse
 
 import javax.inject.{Inject, Singleton}
 import scala.concurrent.Future
@@ -153,4 +155,7 @@ class SubcontractorService @Inject() (repo: CisMonthlyReturnSource) {
   ): Future[GetSubcontractorResponse] =
     repo.getSubcontractor(cisId, subbieResourceRef)
 
+  def updateSubcontractor(request: UpdateSubcontractorRequest): Future[UpdateSubcontractorResponse] =
+    repo.updateSubcontractor(request)
+
 }

conf/app.routes

@@ -28,7 +28,8 @@ POST       /cis/subcontractor/create-and-update                         uk.gov.h
 GET        /cis/subcontractors/:cisId                                   uk.gov.hmrc.formpproxy.cis.controllers.SubcontractorController.getSubcontractorList(cisId: String)
 GET        /cis/subcontractor/:cisId/:subbieResourceRef/delete-status   uk.gov.hmrc.formpproxy.cis.controllers.SubcontractorController.getSubcontractorForDelete(cisId: String, subbieResourceRef: Long)
 GET        /cis/subcontractor/:cisId/:subbieResourceRef                 uk.gov.hmrc.formpproxy.cis.controllers.SubcontractorController.getSubcontractor(cisId: String, subbieResourceRef: Long)
-POST       /cis/subcontractor/delete                                uk.gov.hmrc.formpproxy.cis.controllers.SubcontractorController.deleteSubcontractor
+POST       /cis/subcontractor/delete                                    uk.gov.hmrc.formpproxy.cis.controllers.SubcontractorController.deleteSubcontractor
+POST        /cis/subcontractor/update                                   uk.gov.hmrc.formpproxy.cis.controllers.SubcontractorController.updateSubcontractor
 
 POST       /submissions/create                                      uk.gov.hmrc.formpproxy.cis.controllers.SubmissionController.createSubmission()
 POST       /submissions/update                                      uk.gov.hmrc.formpproxy.cis.controllers.SubmissionController.updateSubmission()