From 4a713cf18636281ae8970de4e960a9f39b45bf58 Mon Sep 17 00:00:00 2001 From: NguyenND Date: Fri, 7 Aug 2026 10:01:56 -0400 Subject: [PATCH] Aug 7 - Update issue comment, customers now can see the comment --- CLAUDE.md | 3 ++- app/routes/issues.py | 10 +++++++++- app/templates/issues/view.html | 21 ++++++++++++++++++--- config.py | 13 +++++++++++++ 4 files changed, 42 insertions(+), 5 deletions(-) diff --git a/CLAUDE.md b/CLAUDE.md index bc2a10a..7424096 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -166,6 +166,7 @@ part of the tree — see §7. Device registration on the API side lives in | `GROQ_MODEL` | Optional. Groq model ID. Defaults to `llama-3.3-70b-versatile`. | | `ENROLLMENT_NOTIFY_EMAILS` | Optional. Comma-separated extra addresses alerted on a new enrollment, **in addition to** every active `admin` account. For people who should be told but hold no JQC login. | | `ENROLLMENT_DIR` | Optional. Directory for enrollment-form JSON submissions. Defaults to `/enrollments` (git-ignored). Created at boot. | +| `COMMENTS_VISIBLE_TO_ALL` | Optional, default `true`. **TEMPORARY (Aug 2026).** When true, customers see *every* comment on an issue, not only those ticked "Share with customer". Set `false` to restore the phase22 staff-only filtering — `is_customer_visible` is still written on every comment, so the revert needs no data repair. | | `PHOTO_STAMP_ENABLED` | Optional, default `true`. Burns a capture-time + geo overlay into photos uploaded via `POST /api/v1/photos/upload`. Set `false` to store raw uploads. | ### Email SSL Auto-Detection @@ -1246,7 +1247,7 @@ Rendered in `dashboard.html` for `current_user.role == 'customer'`. Uses a Boots - Each bubble shows: colored avatar circle (color keyed to `author.id % 7`), display name, role badge (Staff / Customer), `is_customer_visible` badge (staff-only view), status-at-time badge, timestamp, and body. - **Staff commenting:** A hidden checkbox `name="is_customer_visible"` in the Add Comment form defaults to unchecked (staff-only). Checking it marks the comment visible to customers. - **Customer commenting:** Only shown when `can_customer_comment = is_following or issue.reported_by == current_user.id`. Customer POST bypasses `IssueUpdateForm`; the route sets `is_customer_visible=True` unconditionally. -- **Read filtering:** `GET issues/view` passes `filter_by(is_customer_visible=True)` to customers; staff receive all comments. +- **Read filtering:** `GET issues/view` passes `filter_by(is_customer_visible=True)` to customers; staff receive all comments. **Gated by `COMMENTS_VISIBLE_TO_ALL` (temporary, Aug 2026)** — while that config is true the filter is skipped entirely and customers see every comment. The route passes `comments_open` to the template, which then (a) suppresses the per-comment "Customer visible" / "Staff only" badges, since they would misstate what the customer can actually see, and (b) hides the "Share with customer" tick behind a warning banner reading *"Comments are currently visible to everyone… Do not post internal-only notes here."* The checkbox value is still posted and stored, so flipping the config back restores both the filtering and the badges immediately. ### Inspection List Filters diff --git a/app/routes/issues.py b/app/routes/issues.py index c9de50c..da54f7c 100644 --- a/app/routes/issues.py +++ b/app/routes/issues.py @@ -688,7 +688,14 @@ def view(issue_id): return redirect(url_for('issues.view', issue_id=issue_id)) is_following = issue.is_followed_by(current_user) - if current_user.role == 'customer': + + # TEMPORARY (Aug 2026) — COMMENTS_VISIBLE_TO_ALL lifts the phase22 + # restriction so customers see every comment on the issue, not only the + # ones ticked "Share with customer". is_customer_visible is still recorded + # on every comment, so setting the flag back to false restores the old + # filtering with nothing to repair. See config.py. + comments_open = current_app.config.get('COMMENTS_VISIBLE_TO_ALL', False) + if current_user.role == 'customer' and not comments_open: comments = (issue.comments .filter_by(is_customer_visible=True) .order_by(IssueComment.created_at.asc()).all()) @@ -698,6 +705,7 @@ def view(issue_id): issue=issue, form=form, comments=comments, + comments_open=comments_open, is_following=is_following) diff --git a/app/templates/issues/view.html b/app/templates/issues/view.html index bff63c3..892d4bb 100644 --- a/app/templates/issues/view.html +++ b/app/templates/issues/view.html @@ -235,8 +235,11 @@ {% else %} {{ c.author.role|replace('_',' ')|title }} {% endif %} - {# Visibility indicator — staff only #} - {% if current_user.role != 'customer' %} + {# Visibility indicator — staff only. + While comments_open is set, EVERY comment is visible to the + customer, so the old "Staff only" badge would be a lie. It is + suppressed rather than shown incorrectly. #} + {% if current_user.role != 'customer' and not comments_open %} {% if c.is_customer_visible %} @@ -286,8 +289,20 @@ + {# While comments_open is set, every comment reaches the customer, so + the "Share with customer" tick decides nothing. Saying so plainly + matters: a staff member must not write something they believe is + private. The checkbox is still posted and recorded, so turning the + setting off restores its meaning immediately. #} + {% if comments_open %} +
+ + Comments are currently visible to everyone, including + the customer. Do not post internal-only notes here. +
+ {% endif %}
-
+