diff --git a/.target-last-build b/.target-last-build index 8f8b46d..84fbc6a 100644 --- a/.target-last-build +++ b/.target-last-build @@ -1 +1 @@ -hh-dev:hh-dev-build-1784025225|1784026493 +hh-dev:hh-dev-build-1784453317|1784453370 diff --git a/apps/organizations/ui_views.py b/apps/organizations/ui_views.py index 10b102e..9545608 100644 --- a/apps/organizations/ui_views.py +++ b/apps/organizations/ui_views.py @@ -3017,13 +3017,32 @@ def department_record_complaint(request, pk): department = get_object_or_404(Department, pk=pk if False else complaint.department_id) user = request.user + + # A department member may view a complaint when their department is the + # complaint's primary department (and it has been dispatched) OR when their + # department is one of the routed involved departments (and that routing + # was sent). This mirrors the OR-filter used to surface complaints on the + # department detail page, so the modal authorizes exactly the records the + # user can already see in the list. + allowed_dept_ids = set() + if complaint.department_id and complaint.sent_to_department: + allowed_dept_ids.add(complaint.department_id) + allowed_dept_ids.update( + complaint.involved_departments.filter(sent=True).values_list("department_id", flat=True) + ) + + dept_member_ok = user.department_id in allowed_dept_ids + director_ok = user.is_director() and user.get_directed_departments().filter( + id__in=allowed_dept_ids + ).exists() + if not ( user.is_px_admin() or (user.is_hospital_admin() and user.hospital == complaint.hospital) - or (user.is_champion() and user.department_id == complaint.department_id) - or (user.is_department_manager() and user.department_id == complaint.department_id) - or (user.is_basic_staff() and user.department_id == complaint.department_id) - or (user.is_director() and user.get_directed_departments().filter(id=complaint.department_id).exists()) + or (user.is_champion() and dept_member_ok) + or (user.is_department_manager() and dept_member_ok) + or (user.is_basic_staff() and dept_member_ok) + or director_ok ): return JsonResponse({"error": "Access denied"}, status=403) diff --git a/templates/components/send_to_modal.html b/templates/components/send_to_modal.html index 3c9bef1..6b6c113 100644 --- a/templates/components/send_to_modal.html +++ b/templates/components/send_to_modal.html @@ -22,45 +22,18 @@ Required context variables: -
{% trans "Select a person or department to send this item to for response." %}
+{% trans "Select a department to send this item to for response." %}