Add phase 3 consultant task execution workflow

app/modules/work_detail/ui.py

@@ -12,7 +12,7 @@ from app.core.security.session_auth import get_current_user
 from app.core.templating import templates
 from app.modules.core.rbac.deps import get_user_permissions, get_user_roles
 from app.modules.services.models import ServiceTaskDocumentRequest
-from app.modules.work_detail.service import create_document_request, get_task_for_action, load_unified_engagement_detail, save_task_comment, save_task_status, update_document_request
+from app.modules.work_detail.service import assign_task_to_consultant, create_document_request, get_task_for_action, load_unified_engagement_detail, review_consultant_submission, save_task_comment, save_task_status, update_document_request
 
 router = APIRouter(prefix="/work", tags=["unified-work-detail-ui"])
 
@@ -221,3 +221,56 @@ async def unified_document_request_status(request: Request, request_id: int, csr
         db.rollback(); raise
     finally:
         db.close()
+
+
+@router.post("/tasks/{task_id}/consultant-assignment")
+async def unified_consultant_assignment_update(request: Request, task_id: int, csrf_token: str = Form(...), consultant_id: str = Form(""), consultant_due_date: str = Form("")):
+    try:
+        validate_csrf(request, csrf_token)
+    except PermissionError:
+        return _csrf_rejected(request)
+    db = CommonSessionLocal()
+    try:
+        user = get_current_user(request, db=db)
+        if not user:
+            return RedirectResponse(url="/login", status_code=303)
+        task, access = get_task_for_action(db, user=user, task_id=task_id)
+        if not task or not access:
+            return RedirectResponse(url=_fallback_for_user(db, user), status_code=303)
+        parsed_consultant_id = int(consultant_id) if consultant_id.strip() else None
+        parsed_due = date.fromisoformat(consultant_due_date) if consultant_due_date else None
+        if not assign_task_to_consultant(db, task=task, access=access, consultant_id=parsed_consultant_id, due_date=parsed_due, user_id=user.id):
+            return RedirectResponse(url=f"/work/engagements/{task.subscription_id}?error=consultant_assignment_not_allowed", status_code=303)
+        db.commit()
+        return RedirectResponse(url=f"/work/engagements/{task.subscription_id}?consultant_assignment=updated", status_code=303)
+    except (ValueError, TypeError):
+        db.rollback()
+        return RedirectResponse(url=f"/work/engagements/{task.subscription_id if 'task' in locals() and task else ''}?error=invalid_consultant_assignment", status_code=303)
+    except Exception:
+        db.rollback(); raise
+    finally:
+        db.close()
+
+
+@router.post("/tasks/{task_id}/consultant-review")
+async def unified_consultant_submission_review(request: Request, task_id: int, csrf_token: str = Form(...), action: str = Form(...), note: str = Form("")):
+    try:
+        validate_csrf(request, csrf_token)
+    except PermissionError:
+        return _csrf_rejected(request)
+    db = CommonSessionLocal()
+    try:
+        user = get_current_user(request, db=db)
+        if not user:
+            return RedirectResponse(url="/login", status_code=303)
+        task, access = get_task_for_action(db, user=user, task_id=task_id)
+        if not task or not access:
+            return RedirectResponse(url=_fallback_for_user(db, user), status_code=303)
+        if not review_consultant_submission(db, task=task, access=access, action=action, note=note, user_id=user.id):
+            return RedirectResponse(url=f"/work/engagements/{task.subscription_id}?error=consultant_review_not_allowed", status_code=303)
+        db.commit()
+        return RedirectResponse(url=f"/work/engagements/{task.subscription_id}?consultant_review=updated", status_code=303)
+    except Exception:
+        db.rollback(); raise
+    finally:
+        db.close()