06/09 Update a customer can comment on it issue

app/routes/issues.py

@@ -227,7 +227,28 @@ def view(issue_id):
             flash('Access denied.', 'danger')
             return redirect(url_for('issues.index'))
         if request.method == 'POST':
-            abort(403)
+            # Customers may only add a comment, and only on issues they follow or reported
+            can_comment = (issue.is_followed_by(current_user) or issue.reported_by == current_user.id)
+            if not can_comment:
+                abort(403)
+            comment_body = request.form.get('update_notes', '').strip()
+            if not comment_body:
+                flash('Comment cannot be empty.', 'warning')
+                return redirect(url_for('issues.view', issue_id=issue_id))
+            comment = IssueComment(
+                issue_id=issue.id,
+                user_id=current_user.id,
+                status_at_time=issue.status,
+                body=comment_body,
+                is_customer_visible=True,   # customer comments are always visible to all
+            )
+            db.session.add(comment)
+            db.session.commit()
+            log_action(ACTION_UPDATE, 'Issue', issue.id,
+                       f'#{issue.id}',
+                       'customer comment added')
+            flash('Comment posted.', 'success')
+            return redirect(url_for('issues.view', issue_id=issue_id))
 
     form  = IssueUpdateForm(obj=issue)
     staff = User.query.filter(User.role.in_(['admin', 'director', 'inspector'])).order_by(User.username).all()
@@ -270,10 +291,11 @@ def view(issue_id):
         comment_body = form.update_notes.data.strip() if form.update_notes.data else ''
         if comment_body:
             comment = IssueComment(
-                issue_id       = issue.id,
-                user_id        = current_user.id,
-                status_at_time = issue.status,
-                body           = comment_body,
+                issue_id            = issue.id,
+                user_id             = current_user.id,
+                status_at_time      = issue.status,
+                body                = comment_body,
+                is_customer_visible = 'is_customer_visible' in request.form,
             )
             db.session.add(comment)
 
@@ -418,7 +440,12 @@ def view(issue_id):
         return redirect(url_for('issues.view', issue_id=issue_id))
 
     is_following = issue.is_followed_by(current_user)
-    comments     = issue.comments.order_by(IssueComment.created_at.asc()).all()
+    if current_user.role == 'customer':
+        comments = (issue.comments
+                    .filter_by(is_customer_visible=True)
+                    .order_by(IssueComment.created_at.asc()).all())
+    else:
+        comments = issue.comments.order_by(IssueComment.created_at.asc()).all()
     return render_template('issues/view.html',
                            issue=issue,
                            form=form,