Phase 2 fix remaining RBAC safe responses and work route aliases

app/modules/work_detail/ui.py

@@ -2,6 +2,7 @@ from __future__ import annotations
 
 from fastapi import APIRouter, Form, Request
 from fastapi.responses import RedirectResponse
+from app.core.http_responses import forbidden_response, not_found_response
 
 from app.core.db.common import CommonSessionLocal
 from app.core.security.csrf import get_or_create_csrf_token, validate_csrf
@@ -38,6 +39,39 @@ def _fallback_for_user(db, user) -> str:
     return "/employee/work"
 
 
+@router.get("")
+def unified_work_board(request: Request):
+    """Compatibility alias for the common /work route.
+
+    Existing functionality remains in the Services Work Tracker module.
+    This route only prevents stale bookmarks/tests from receiving a 404.
+    """
+    db = CommonSessionLocal()
+    try:
+        user = get_current_user(request, db=db)
+        if not user:
+            return RedirectResponse(url="/login", status_code=303)
+        return RedirectResponse(url="/services/work-tracker", status_code=303)
+    finally:
+        db.close()
+
+
+@router.get("/engagements")
+def unified_engagements_index(request: Request):
+    """Compatibility alias for /work/engagements.
+
+    Engagement listing is maintained under /services/engagements.
+    """
+    db = CommonSessionLocal()
+    try:
+        user = get_current_user(request, db=db)
+        if not user:
+            return RedirectResponse(url="/login", status_code=303)
+        return RedirectResponse(url="/services/engagements", status_code=303)
+    finally:
+        db.close()
+
+
 @router.get("/engagements/{engagement_id}")
 def unified_engagement_detail(request: Request, engagement_id: int):
     db = CommonSessionLocal()
@@ -47,7 +81,7 @@ def unified_engagement_detail(request: Request, engagement_id: int):
             return RedirectResponse(url="/login", status_code=303)
         detail = load_unified_engagement_detail(db, request=request, user=user, engagement_id=engagement_id)
         if not detail:
-            return RedirectResponse(url=_fallback_for_user(db, user), status_code=303)
+            return not_found_response(request, "Work engagement not found or access denied")
         return templates.TemplateResponse(
             "modules/work_detail/templates/work_detail/engagement_detail.html",
             _base_ctx(request, db, user, title="Work Details", **detail),