Add phase 2 consultant visibility communications and document requests

app/modules/work_detail/ui.py

@@ -1,5 +1,7 @@
 from __future__ import annotations
 
+from datetime import date
+
 from fastapi import APIRouter, Form, Request
 from fastapi.responses import RedirectResponse
 from app.core.http_responses import forbidden_response, not_found_response
@@ -9,7 +11,8 @@ from app.core.security.csrf import get_or_create_csrf_token, validate_csrf
 from app.core.security.session_auth import get_current_user
 from app.core.templating import templates
 from app.modules.core.rbac.deps import get_user_permissions, get_user_roles
-from app.modules.work_detail.service import get_task_for_action, load_unified_engagement_detail, save_task_comment, save_task_status
+from app.modules.services.models import ServiceTaskDocumentRequest
+from app.modules.work_detail.service import create_document_request, get_task_for_action, load_unified_engagement_detail, save_task_comment, save_task_status, update_document_request
 
 router = APIRouter(prefix="/work", tags=["unified-work-detail-ui"])
 
@@ -167,3 +170,54 @@ async def unified_task_comment_add(
         raise
     finally:
         db.close()
+
+
+@router.post("/tasks/{task_id}/document-requests")
+async def unified_document_request_add(request: Request, task_id: int, csrf_token: str = Form(...), title: str = Form(...), description: str = Form(""), requested_from: str = Form("client_and_consultant"), due_date: str = Form(""), request_type: str = Form("document")):
+    try:
+        validate_csrf(request, csrf_token)
+    except PermissionError:
+        return _csrf_rejected(request)
+    db = CommonSessionLocal()
+    try:
+        user = get_current_user(request, db=db)
+        if not user:
+            return RedirectResponse(url="/login", status_code=303)
+        task, access = get_task_for_action(db, user=user, task_id=task_id)
+        if not task or not access:
+            return RedirectResponse(url=_fallback_for_user(db, user), status_code=303)
+        parsed_due = date.fromisoformat(due_date) if due_date else None
+        row = create_document_request(db, task=task, access=access, title=title, description=description, requested_from=requested_from, due_date=parsed_due, request_type=request_type, user_id=user.id)
+        if not row:
+            return RedirectResponse(url=f"/work/engagements/{task.subscription_id}?error=request_not_allowed", status_code=303)
+        db.commit()
+        return RedirectResponse(url=f"/work/engagements/{task.subscription_id}?request=created", status_code=303)
+    except Exception:
+        db.rollback(); raise
+    finally:
+        db.close()
+
+
+@router.post("/document-requests/{request_id}/status")
+async def unified_document_request_status(request: Request, request_id: int, csrf_token: str = Form(...), status: str = Form(...), response_note: str = Form("")):
+    try:
+        validate_csrf(request, csrf_token)
+    except PermissionError:
+        return _csrf_rejected(request)
+    db = CommonSessionLocal()
+    try:
+        user = get_current_user(request, db=db)
+        if not user:
+            return RedirectResponse(url="/login", status_code=303)
+        row = db.get(ServiceTaskDocumentRequest, request_id)
+        if not row or not row.is_active:
+            return not_found_response(request, "Document request not found")
+        task, access = get_task_for_action(db, user=user, task_id=row.task_instance_id)
+        if not task or not access or not update_document_request(db, request_row=row, access=access, status=status, response_note=response_note, user_id=user.id):
+            return RedirectResponse(url=_fallback_for_user(db, user), status_code=303)
+        db.commit()
+        return RedirectResponse(url=f"/work/engagements/{row.subscription_id}?request=updated", status_code=303)
+    except Exception:
+        db.rollback(); raise
+    finally:
+        db.close()