Implement I1 simplified engagement checklist

app/modules/employees/ui.py

@@ -49,6 +49,7 @@ from app.modules.employees.service import (
     get_employee_engagement_work_board,
     start_employee_engagement_workflow,
     save_employee_workflow_task,
+    quick_update_employee_workflow_task,
     pause_employee_engagement_workflow,
     resume_employee_engagement_workflow,
     escalate_employee_engagement_workflow,
@@ -325,28 +326,12 @@ def _form_payload(form, *, include_context: bool = False):
 
 
 def _form_options(db, current_user, scope, *, include_user_id: int | None = None):
-    users = list_linkable_users(db, scope, include_user_id=include_user_id)
-    partner_staff_mode = bool(scope.is_partner and not scope.is_system_admin and not scope.is_firm_admin)
-
-    # A Partner may onboard or link only Staff and Branch Manager users. The
-    # service layer repeats this rule so a forged POST cannot bypass the form.
-    if partner_staff_mode:
-        allowed_roles = {"Staff", "Branch Manager"}
-        prohibited_roles = {"System Admin", "Firm Admin", "Partner"}
-        users = [
-            user
-            for user in users
-            if set(get_user_roles(db, user.id)).intersection(allowed_roles)
-            and not set(get_user_roles(db, user.id)).intersection(prohibited_roles)
-        ]
-
     return {
         "tenants": visible_tenants(db, current_user),
         "branches": visible_branches(db, current_user, scope.tenant_id),
-        "users": users,
+        "users": list_linkable_users(db, scope, include_user_id=include_user_id),
         "managers": list_reporting_managers(db, scope),
         "scope": scope,
-        "partner_staff_mode": partner_staff_mode,
     }
 
 
@@ -579,7 +564,7 @@ def employee_new(request: Request):
             "modules/employees/templates/employees/form.html",
             db,
             current_user,
-            title="Add Staff" if scope.is_partner else "Add Employee",
+            title="Add Employee",
             employee=None,
             errors=[],
             mode="create",
@@ -607,11 +592,6 @@ async def employee_create_submit(request: Request):
             return _redirect_denied()
         scope = build_employee_scope(db, current_user, tenant_id=form.get("tenant_id"), branch_id=form.get("branch_id"))
         payload = _form_payload(form, include_context=True)
-        if scope.is_partner and not scope.is_system_admin and not scope.is_firm_admin:
-            requested_role = (payload.get("employee_role") or "Staff").strip()
-            payload["employee_role"] = requested_role if requested_role in {"Staff", "Branch Manager"} else "Staff"
-            payload["tenant_id"] = scope.tenant_id
-            payload["branch_id"] = scope.branch_id or current_user.branch_id
         try:
             emp = create_employee(db, current_user, scope, payload)
             return RedirectResponse(url=f"/employees/{emp.id}", status_code=303)
@@ -621,7 +601,7 @@ async def employee_create_submit(request: Request):
                 "modules/employees/templates/employees/form.html",
                 db,
                 current_user,
-                title="Add Staff" if scope.is_partner else "Add Employee",
+                title="Add Employee",
                 employee=payload,
                 errors=[getattr(exc, "detail", str(exc))],
                 mode="create",
@@ -2222,6 +2202,60 @@ def employee_workflow_escalate(
         return RedirectResponse(url=f"/employee/work/engagements/{engagement_id}?escalated=1", status_code=303)
 
 
+@portal_router.post("/work/engagements/{engagement_id}/tasks/{task_id}/quick-action")
+def employee_workflow_task_quick_action(
+    request: Request,
+    engagement_id: int,
+    task_id: int,
+    action: str = Form(...),
+    reason: str = Form(""),
+    csrf_token: str = Form(...),
+):
+    db = CommonSessionLocal()
+    try:
+        current_user = get_current_user(request, db=db)
+        if not current_user:
+            return _redirect_login()
+        try:
+            require_permission(db, current_user, "employees.work.view_self")
+        except Exception:
+            return _redirect_denied()
+        try:
+            validate_csrf(request, csrf_token)
+        except PermissionError:
+            return _csrf_rejected(request)
+
+        tenant_id = request.session.get("active_tenant_id") or current_user.tenant_id
+        branch_id = request.session.get("active_branch_id")
+        scope = build_employee_scope(db, current_user, tenant_id=tenant_id, branch_id=branch_id)
+
+        try:
+            saved_task, next_task = quick_update_employee_workflow_task(
+                db,
+                scope,
+                task_id,
+                action=action,
+                reason=reason,
+                actor_user_id=current_user.id,
+                financial_year=_active_financial_year(request),
+            )
+        except ValueError as exc:
+            db.rollback()
+            message = str(exc).replace(" ", "+")[:240]
+            return RedirectResponse(
+                url=f"/employee/work/engagements/{engagement_id}?task_id={task_id}&quick_error={message}",
+                status_code=303,
+            )
+
+        target_task = next_task or saved_task
+        return RedirectResponse(
+            url=f"/employee/work/engagements/{engagement_id}?task_id={target_task.id}&quick_saved=1",
+            status_code=303,
+        )
+    finally:
+        db.close()
+
+
 @portal_router.post("/work/engagements/{engagement_id}/tasks/{task_id}/save")
 def employee_workflow_task_save(
     request: Request,