BURs: allow only pending BURs to be rejected.

Fix it being possible to reject approved BURs, or to re-reject already
rejected BURs.

Rejecting an approved BUR wouldn't revert the aliases/implications, but
it would change the BUR's status to rejected.

app/controllers/bulk_update_requests_controller.rb

@@ -16,6 +16,7 @@ class BulkUpdateRequestsController < ApplicationController
 
   def show
     @bulk_update_request = BulkUpdateRequest.find(params[:id])
+    respond_with(@bulk_update_request)
   end
 
   def edit
@@ -37,7 +38,7 @@ class BulkUpdateRequestsController < ApplicationController
   end
 
   def destroy
-    if @bulk_update_request.editable?(CurrentUser.user)
+    if @bulk_update_request.rejectable?(CurrentUser.user)
       @bulk_update_request.reject!(CurrentUser.user)
       flash[:notice] = "Bulk update request rejected"
       respond_with(@bulk_update_request, :location => bulk_update_requests_path)

app/models/bulk_update_request.rb

@@ -181,6 +181,14 @@ class BulkUpdateRequest < ApplicationRecord
     user_id == user.id || user.is_builder?
   end
 
+  def approvable?(user)
+    !is_approved? && user.is_admin?
+  end
+
+  def rejectable?(user)
+    is_pending? && editable?(user)
+  end
+
   def reason_with_link
     "[bur:#{id}]\n\nReason: #{reason}"
   end