Aug 7 - Update issue comment, customers now can see the comment

app/routes/issues.py

@@ -688,7 +688,14 @@ def view(issue_id):
         return redirect(url_for('issues.view', issue_id=issue_id))
 
     is_following = issue.is_followed_by(current_user)
-    if current_user.role == 'customer':
+
+    # TEMPORARY (Aug 2026) — COMMENTS_VISIBLE_TO_ALL lifts the phase22
+    # restriction so customers see every comment on the issue, not only the
+    # ones ticked "Share with customer". is_customer_visible is still recorded
+    # on every comment, so setting the flag back to false restores the old
+    # filtering with nothing to repair. See config.py.
+    comments_open = current_app.config.get('COMMENTS_VISIBLE_TO_ALL', False)
+    if current_user.role == 'customer' and not comments_open:
         comments = (issue.comments
                     .filter_by(is_customer_visible=True)
                     .order_by(IssueComment.created_at.asc()).all())
@@ -698,6 +705,7 @@ def view(issue_id):
                            issue=issue,
                            form=form,
                            comments=comments,
+                           comments_open=comments_open,
                            is_following=is_following)
 
 

app/templates/issues/view.html

@@ -235,8 +235,11 @@
                 {% else %}
                 <span class="badge bg-secondary" style="font-size:.65rem;">{{ c.author.role|replace('_',' ')|title }}</span>
                 {% endif %}
-                {# Visibility indicator — staff only #}
-                {% if current_user.role != 'customer' %}
+                {# Visibility indicator — staff only.
+                   While comments_open is set, EVERY comment is visible to the
+                   customer, so the old "Staff only" badge would be a lie. It is
+                   suppressed rather than shown incorrectly. #}
+                {% if current_user.role != 'customer' and not comments_open %}
                   {% if c.is_customer_visible %}
                   <span class="badge bg-success bg-opacity-10 text-success border border-success"
                         style="font-size:.6rem;" title="Customer can see this comment">
@@ -286,8 +289,20 @@
             <textarea name="update_notes" class="form-control" rows="3"
                       placeholder="Write a comment…" required></textarea>
           </div>
+          {# While comments_open is set, every comment reaches the customer, so
+             the "Share with customer" tick decides nothing. Saying so plainly
+             matters: a staff member must not write something they believe is
+             private. The checkbox is still posted and recorded, so turning the
+             setting off restores its meaning immediately. #}
+          {% if comments_open %}
+          <div class="alert alert-warning py-2 px-3 small mb-2">
+            <i class="bi bi-eye me-1"></i>
+            <strong>Comments are currently visible to everyone,</strong> including
+            the customer. Do not post internal-only notes here.
+          </div>
+          {% endif %}
           <div class="d-flex align-items-center justify-content-between flex-wrap gap-2">
-            <div class="form-check form-check-inline mb-0">
+            <div class="form-check form-check-inline mb-0 {{ 'd-none' if comments_open }}">
               <input class="form-check-input" type="checkbox"
                      name="is_customer_visible" id="is_customer_visible" value="1">
               <label class="form-check-label small text-muted" for="is_customer_visible">