Add inline documents and messages to I1 checklist

app/modules/documents/templates/documents/task_documents.html

@@ -11,7 +11,7 @@
       </p>
     </div>
     <div class="flex flex-wrap gap-2">
-      <a href="/services/engagements/{{ engagement.id }}" class="rounded-xl border border-slate-300 px-4 py-2 text-sm font-medium text-slate-700 hover:bg-slate-50">Engagement</a>
+      <a href="{{ back_url }}" class="rounded-xl border border-brand-200 bg-brand-50 px-4 py-2 text-sm font-semibold text-brand-700 hover:bg-brand-100">Back to Engagement Task</a>
       <a href="/documents/engagements/{{ engagement.id }}" class="rounded-xl border border-slate-300 px-4 py-2 text-sm font-medium text-slate-700 hover:bg-slate-50">Engagement Documents</a>
     </div>
   </div>
@@ -51,6 +51,7 @@
     <h3 class="text-sm font-semibold text-slate-900">Upload Task Document</h3>
     <form method="post" action="/documents/tasks/{{ task.id }}/upload" enctype="multipart/form-data" class="mt-4 grid gap-4 md:grid-cols-2">
       <input type="hidden" name="csrf_token" value="{{ csrf_token }}">
+      <input type="hidden" name="return_to" value="{{ return_to }}">
       <div>
         <label class="mb-1 block text-xs font-semibold uppercase tracking-wide text-slate-500">Requirement</label>
         <select name="requirement_id" class="w-full rounded-xl border border-slate-300 px-3 py-2 text-sm">

app/modules/documents/ui.py

@@ -272,6 +272,13 @@ def _require_user(request: Request, db, permission_code: str):
 
 
 
+def _safe_documents_return_url(value: str | None, fallback: str) -> str:
+    candidate = (value or "").strip()
+    if candidate.startswith("/") and not candidate.startswith("//"):
+        return candidate
+    return fallback
+
+
 def _active_financial_year(request: Request) -> str | None:
     value = request.session.get("active_financial_year") or getattr(request.state, "year_code", None)
     value = (value or "").strip()
@@ -440,6 +447,8 @@ def task_documents(request: Request, task_id: int):
             requirement_status=requirement_status,
             documents=documents,
             can_upload=user_can_upload_to_engagement(db, user, engagement, scope),
+            return_to=_safe_documents_return_url(request.query_params.get("return_to"), f"/documents/engagements/{engagement.id}"),
+            back_url=_safe_documents_return_url(request.query_params.get("return_to"), f"/documents/engagements/{engagement.id}"),
         )
     finally:
         db.close()
@@ -459,11 +468,13 @@ def upload_task_document(
     evidence_type: str | None = Form(None),
     evidence_description: str | None = Form(None),
     file: UploadFile = File(...),
+    return_to: str = Form(""),
     csrf_token: str = Form(...),
 ):
     validate_csrf(request, csrf_token)
     db = CommonSessionLocal()
     try:
+        return_target = _safe_documents_return_url(return_to, f"/documents/tasks/{task_id}")
         user, response = _require_user(request, db, "documents.upload")
         if response:
             return response
@@ -478,12 +489,12 @@ def upload_task_document(
         if is_row_financial_year_locked(db, engagement):
             return RedirectResponse(url=f"/documents/engagements/{engagement.id}?year_locked=1", status_code=303)
         if not file or not file.filename:
-            return RedirectResponse(url=f"/documents/tasks/{task_id}?error=missing_file", status_code=303)
+            return RedirectResponse(url=return_target if return_to else f"/documents/tasks/{task_id}?error=missing_file", status_code=303)
         requirement = None
         if requirement_id and str(requirement_id).strip():
             requirement = get_task_document_requirement(db, requirement_id=int(requirement_id), tenant_id=task.tenant_id)
             if not requirement or requirement.firm_task_template_id != task.firm_task_template_id:
-                return RedirectResponse(url=f"/documents/tasks/{task_id}?error=invalid_requirement", status_code=303)
+                return RedirectResponse(url=return_target if return_to else f"/documents/tasks/{task_id}?error=invalid_requirement", status_code=303)
         try:
             doc = save_uploaded_task_document(
                 db,
@@ -511,8 +522,8 @@ def upload_task_document(
                 db.commit()
             except Exception:
                 db.rollback()
-            return RedirectResponse(url=f"/documents/tasks/{task_id}?error=upload_failed", status_code=303)
-        return RedirectResponse(url=f"/documents/tasks/{task_id}?uploaded=1", status_code=303)
+            return RedirectResponse(url=return_target if return_to else f"/documents/tasks/{task_id}?error=upload_failed", status_code=303)
+        return RedirectResponse(url=return_target if return_to else f"/documents/tasks/{task_id}?uploaded=1", status_code=303)
     finally:
         db.close()