feat(po): allow attachments in any PO state except rejected/cancelled #146

Merged

shad0w merged 1 commit from claude/po-attachments-any-state into master

2026-06-27 20:16:29 +00:00

shad0w commented

2026-06-27 20:12:34 +00:00

Owner

Builds on #144. Broadens the feature-flagged attachment affordance — same flag NEXT_PUBLIC_CLOSED_PO_ATTACHMENTS_ENABLED — from CLOSED-only to any PO state except REJECTED / CANCELLED, for the same roles: the PO's own submitter plus Accounts / Manager / SuperUser.

Changes

lib/permissions.ts: canAddClosedPoAttachment → canAddPoAttachment(role, status, { isSubmitter }) — allows the submitter + ACCOUNTS/MANAGER/SUPERUSER in any non-voided state; REJECTED/CANCELLED always refused.
uploadPoDocuments: voided POs refused regardless of the flag; flag-on restricts uploads to those roles in any live state (the normal create/receipt actors qualify, so those flows keep working); flag-off keeps legacy behaviour (closed POs immutable).
po-detail.tsx: the Attachments card shows the uploader for any non-voided state when permitted (not just CLOSED).
Renamed ClosedPoAttachmentUploader → PoAttachmentUploader; test file → po-attachment-permissions.test.ts.
Docs: feature-flags.ts, .env.example, CLAUDE.md, and the Feature Flags + Environment Variables wiki pages.

Tests

po-attachment-permissions.test.ts (flag on): submitter / Accounts / Manager / SuperUser may attach in CLOSED and live states (MGR_REVIEW, MGR_APPROVED, SENT_FOR_PAYMENT, PAID_DELIVERED, EDITS_REQUESTED); REJECTED/CANCELLED refused even for the submitter; non-allowed roles refused. po-document-upload.test.ts keeps the flag-off cases.

Full unit (347) + integration (301) suites green; tsc --noEmit clean.

Generated with Claude Code.

Builds on #144. Broadens the feature-flagged attachment affordance — **same flag** `NEXT_PUBLIC_CLOSED_PO_ATTACHMENTS_ENABLED` — from CLOSED-only to **any PO state except `REJECTED` / `CANCELLED`**, for the same roles: the PO's own submitter plus **Accounts / Manager / SuperUser**. ## Changes - `lib/permissions.ts`: `canAddClosedPoAttachment` → **`canAddPoAttachment(role, status, { isSubmitter })`** — allows the submitter + ACCOUNTS/MANAGER/SUPERUSER in any non-voided state; `REJECTED`/`CANCELLED` always refused. - `uploadPoDocuments`: voided POs refused regardless of the flag; flag-on restricts uploads to those roles in any live state (the normal create/receipt actors qualify, so those flows keep working); flag-off keeps legacy behaviour (closed POs immutable). - `po-detail.tsx`: the Attachments card shows the uploader for any non-voided state when permitted (not just CLOSED). - Renamed `ClosedPoAttachmentUploader` → `PoAttachmentUploader`; test file → `po-attachment-permissions.test.ts`. - Docs: `feature-flags.ts`, `.env.example`, `CLAUDE.md`, and the **Feature Flags** + **Environment Variables** wiki pages. ## Tests `po-attachment-permissions.test.ts` (flag on): submitter / Accounts / Manager / SuperUser may attach in CLOSED **and** live states (MGR_REVIEW, MGR_APPROVED, SENT_FOR_PAYMENT, PAID_DELIVERED, EDITS_REQUESTED); REJECTED/CANCELLED refused even for the submitter; non-allowed roles refused. `po-document-upload.test.ts` keeps the flag-off cases. Full unit (347) + integration (301) suites green; `tsc --noEmit` clean. Generated with Claude Code.

shad0w added 1 commit 2026-06-27 20:12:34 +00:00

feat(po): allow attachments in any state except rejected/cancelled

PR checks / checks (pull_request) Successful in 50s

Details

PR checks / integration (pull_request) Successful in 31s

Details

e481eb0a15

Broadens the feature-flagged attachment affordance (same flag,
NEXT_PUBLIC_CLOSED_PO_ATTACHMENTS_ENABLED) from CLOSED-only to **any PO state
except REJECTED / CANCELLED**, for the same roles: the PO's own submitter plus
Accounts / Manager / SuperUser.

- lib/permissions.ts: canAddClosedPoAttachment → canAddPoAttachment(role,
  status, { isSubmitter }); allows the submitter + ACCOUNTS/MANAGER/SUPERUSER
  in any non-voided state. REJECTED/CANCELLED are always refused.
- uploadPoDocuments: voided POs are refused regardless of the flag; with the
  flag on, uploads are restricted to those roles in any live state (the normal
  create/receipt actors qualify, so those flows keep working); with the flag
  off, the legacy behaviour stands (closed POs immutable).
- po-detail.tsx: the Attachments card now shows the uploader for any non-voided
  state when permitted (not just CLOSED).
- Renamed ClosedPoAttachmentUploader → PoAttachmentUploader and the test file
  to po-attachment-permissions.test.ts (flag-on matrix now covers live states +
  rejected/cancelled refusal). Docs updated (feature-flags, .env.example,
  CLAUDE.md).

Full unit + integration suites green; tsc clean.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>