An order ID exists and its submitted status passes validation. What must happen before th…

An order ID exists and its submitted status passes validation. What must happen before the update?

1. Authorize the authenticated principal against that order or use an ownership-scoped query.
2. Call permit! so Rails trusts every submitted field.
3. Return the model attributes before saving.
4. Move the update into an after_save callback.