Add confirmation and summary

contracts/views.py

@@ -4,6 +4,7 @@ from django.urls import reverse
 from django.utils import timezone
 from django.template import Template, Context
 from processes.models import ProcessInstance, StepInstance
+from common.consts import UserRoles
 from .models import ContractTemplate, ContractInstance
 from _helpers.utils import jalali_converter2
 
@@ -34,6 +35,20 @@ def contract_step(request, instance_id, step_id):
     step = get_object_or_404(instance.process.steps, id=step_id)
     previous_step = instance.process.steps.filter(order__lt=step.order).last()
     next_step = instance.process.steps.filter(order__gt=step.order).first()
+    # Access control:
+    # - INSTALLER: can open step but cannot view contract body (show inline message)
+    # - Others: can view
+    # - Only BROKER can submit/complete this step
+    profile = getattr(request.user, 'profile', None)
+    is_broker = False
+    can_view_contract_body = True
+    try:
+        is_broker = bool(profile and profile.has_role(UserRoles.BROKER))
+        if profile and profile.has_role(UserRoles.INSTALLER):
+            can_view_contract_body = False
+    except Exception:
+        pass
+
     template_obj = ContractTemplate.objects.first()
     if not template_obj:
         return render(request, 'contracts/contract_missing.html', {'instance': instance})
@@ -54,8 +69,11 @@ def contract_step(request, instance_id, step_id):
     contract.rendered_body = rendered
     contract.save()
 
-    # If user submits to go next, mark this step completed and go to next
+    # If user submits to go next, only broker can complete and go to next
     if request.method == 'POST':
+        if not is_broker:
+            from django.http import JsonResponse
+            return JsonResponse({'success': False, 'message': 'شما مجوز تایید این مرحله را ندارید'}, status=403)
         StepInstance.objects.update_or_create(
             process_instance=instance,
             step=step,
@@ -74,6 +92,8 @@ def contract_step(request, instance_id, step_id):
         'template': template_obj,
         'previous_step': previous_step,
         'next_step': next_step,
+        'is_broker': is_broker,
+        'can_view_contract_body': can_view_contract_body,
     })