Merge branch 'main' of https://github.com/leoyliao001/AE_WPM_Demo

Author: leoyliao001

README.md

@@ -102,13 +102,42 @@ python manage.py loaddata scripts\api_data_dump.json
 > Production does not use SQLite at all; the **AE_WPM** service runs against
 > MSSQL (see **Port policy**).
 >
-> On the server (MSSQL), after pulling code that includes new migration files,
-> run:
->
-> ```cmd
-> cd /d "c:\fcous\AE WPM Demo\backend"
-> python manage.py migrate --database=default
-> ```
+### 1c. Sync the pulled changes to SQL Server
+
+Production does not use `backend/db.sqlite3`. After pulling a revision that
+contains new Django migration files, run the migration against SQL Server from
+an elevated PowerShell session on the deployment server. The production
+service uses the repository virtual environment at `E:\AE_WPM_Demo\.venv`.
+
+```powershell
+Set-Location E:\AE_WPM_Demo\backend
+
+# Confirm the database connection and see what will be applied.
+& E:\AE_WPM_Demo\.venv\Scripts\python.exe manage.py showmigrations api
+& E:\AE_WPM_Demo\.venv\Scripts\python.exe manage.py migrate api --plan
+
+# Apply pending migrations to the configured SQL Server database.
+& E:\AE_WPM_Demo\.venv\Scripts\python.exe manage.py migrate api --verbosity 1
+
+# Verify the application and confirm that no migrations remain pending.
+& E:\AE_WPM_Demo\.venv\Scripts\python.exe manage.py check
+& E:\AE_WPM_Demo\.venv\Scripts\python.exe manage.py showmigrations api
+& E:\AE_WPM_Demo\.venv\Scripts\python.exe manage.py migrate api --plan
+```
+
+The SQL Server target is configured through the server `.env` file and/or
+service environment variables, including `DJANGO_DB_NAME`, `DJANGO_DB_HOST`,
+`DJANGO_DB_DRIVER`, and `DJANGO_DB_EXTRA_PARAMS`. Do not replace these with
+the local SQLite database or commit secrets to the repository. The account
+running the command must have the same SQL Server permissions as the `AE_WPM`
+service, which normally uses Windows Trusted Connection.
+
+If the migration command reports a historical migration-record or schema
+inconsistency, inspect the database before making manual changes. The
+repository helper [`repair_and_migrate_mssql.py`](backend/scripts/repair_and_migrate_mssql.py)
+is for that specific recovery case; it is not the normal release command.
+Never delete migration records or alter production data to force a migration
+without an approved database backup and DBA-reviewed recovery plan.
 
 ### 2. Frontend — install dependencies
 

backend/api/services/project_artefacts.py

@@ -22,7 +22,7 @@
     {"id": "mfa", "label": "MFA token / authenticator"},
 ]
 BARRIER_TYPES = ["Licensing", "Permissions", "Hardware", "Network", "Security", "Other"]
-HIRING_TYPES = ["External", "IJP", "Efficiency"]
+HIRING_TYPES = ["Efficiency", "Backfill", "External", "IJP"]
 HIRING_STATUSES = ["Pending", "In Progress", "At Risk", "Onboarded"]
 LANGUAGES = ["English", "Spanish", "French", "German", "Italian", "Portuguese", "Danish", "Dutch", "Other"]
 EXECUTION_FIELDS = ["site", "hiringType", "language", "pidCreationDate", "gscPid", "deletedPid"]

backend/api/test_project_artefacts.py

@@ -10,9 +10,10 @@
 from rest_framework.test import APIClient
 
 from api.models import (
-    AccessEnablement, MigrationIntakeSubmission, ProjectAttributesAccess,
+    AccessEnablement, BusinessCase, MigrationIntakeSubmission, ProjectAttributesAccess,
     ProjectResources, ScopeStatement, ScopeStatementLine, StakeholderRegistration,
 )
+from api.services.business_case import build_business_case
 from api.services.project_artefacts import IT_ITEMS
 
 
@@ -157,6 +158,10 @@ def test_efficiency_does_not_require_recruitment_and_preserves_actual_doj(self):
         self.assertEqual(self.post("resources", "submit_area").status_code, 200)
         self.assertEqual(self.post("resources", "submit").status_code, 200)
 
+    def test_backfill_is_a_valid_hiring_type(self):
+        response = self.post("resources", rows=[{**self.resource(), "hiringType": "Backfill"}])
+        self.assertEqual(response.status_code, 200, response.data)
+
     def test_resource_validation_is_atomic_and_scope_required(self):
         self.assertEqual(self.post("resources", rows=[self.resource()]).status_code, 200)
         for row in ({**self.resource(), "actualDoj": "bad"}, {**self.resource(), "hiringType": "invalid"},
@@ -243,10 +248,16 @@ def test_catalogue_and_quantities_are_validated(self):
         self.client.credentials(HTTP_X_USER_EMAIL="local.dev@localhost")
         self.assertEqual(self.post("access-enablement", itItems=[{"id": item["id"], "qtyConfirmed": 2} for item in IT_ITEMS]).status_code, 400)
 
-    def test_landing_only_shows_accessible_projects_and_never_uses_sample_capacity(self):
+    def test_landing_only_shows_locked_business_case_capacity(self):
         response = self.client.get("/api/migration-dashboard/resources/")
         self.assertEqual(response.status_code, 200)
         self.assertEqual(response.data["count"], 1)
+        self.assertIsNone(response.data["rows"][0]["pipelineFte"])
+        self.assertEqual(response.data["rows"][0]["approvalStatus"], "Not locked")
+        record = BusinessCase.objects.create(project=self.project, status="submitted")
+        record.source_fingerprint = build_business_case(self.project, record)[3]
+        record.save(update_fields=["source_fingerprint"])
+        response = self.client.get("/api/migration-dashboard/resources/")
         self.assertEqual(response.data["rows"][0]["pipelineFte"], 1)
         self.scope.status = "draft"
         self.scope.save()

backend/api/test_scope_page.py

@@ -64,10 +64,12 @@ def test_shared_upload_download_and_lock_all(self):
         self.assertTrue(all(line["lockedAt"] for line in response.data["lines"]))
         self.assertEqual(len({line["lockedAt"] for line in response.data["lines"]}), 1)
 
-    def test_lock_requires_attachment_and_all_values_without_partial_writes(self):
-        self.assertEqual(self.save(self.payload("lock")).status_code, 400)
-        self.assertTrue(all(line.final_fte is None for line in self.statement.lines.all()))
-        self.upload()
+    def test_lock_does_not_require_attachment_and_validates_all_values(self):
+        response = self.save(self.payload("lock"))
+        self.assertEqual(response.status_code, 200, response.data)
+        self.assertTrue(response.data["pageLocked"])
+        self.assertFalse(ScopeStatementEvidence.objects.exists())
+        self.assertEqual(self.save({"action": "unlock"}).status_code, 200)
         payload = self.payload("lock")
         payload["lines"][2]["finalFte"] = None
         self.assertEqual(self.save(payload).status_code, 400)

backend/api/test_super_admin_access.py

@@ -42,6 +42,52 @@ def test_super_admin_can_save_another_requestors_opportunity_assessment(self):
         self.assertEqual(response.data["created_count"], 1)
         self.assertEqual(response.data["error_count"], 0)
 
+    def test_project_dashboard_visibility_follows_access_control_permission(self):
+        ProjectAttributesAccess.objects.create(
+            email="access-admin@example.com", access_control=True,
+        )
+        ProjectAttributesAccess.objects.create(
+            email="maintainer@example.com", migration_intake=True,
+        )
+        for email, expected_ids in (
+            (self.admin, [self.project.pk]),
+            ("access-admin@example.com", [self.project.pk]),
+            ("maintainer@example.com", []),
+            ("OWNER@EXAMPLE.COM", [self.project.pk]),
+            ("other@example.com", []),
+        ):
+            with self.subTest(email=email):
+                self.client.credentials(HTTP_X_USER_EMAIL=email)
+                response = self.client.get("/api/migration-dashboard/projects/", {"mine": 1})
+                self.assertEqual(response.status_code, 200, response.data)
+                self.assertEqual([row["id"] for row in response.data["rows"]], expected_ids)
+                self.assertEqual(response.data["count"], len(expected_ids))
+                self.assertEqual(response.data["summary"]["totalProjects"], len(expected_ids))
+                self.assertEqual(
+                    response.data["scope"],
+                    "all" if email in (self.admin, "access-admin@example.com") else "mine",
+                )
+
+    def test_project_dashboard_requires_sign_in_for_personal_scope(self):
+        self.client.credentials()
+        response = self.client.get("/api/migration-dashboard/projects/", {"mine": 1})
+        self.assertEqual(response.status_code, 401, response.data)
+
+    def test_revoking_access_control_restores_personal_project_scope(self):
+        access = ProjectAttributesAccess.objects.create(
+            email="access-admin@example.com", access_control=True,
+        )
+        self.client.credentials(HTTP_X_USER_EMAIL=access.email)
+        response = self.client.get("/api/migration-dashboard/projects/", {"mine": 1})
+        self.assertEqual(response.status_code, 200, response.data)
+        self.assertEqual(response.data["count"], 1)
+        access.access_control = False
+        access.save(update_fields=["access_control"])
+        response = self.client.get("/api/migration-dashboard/projects/", {"mine": 1})
+        self.assertEqual(response.status_code, 200, response.data)
+        self.assertEqual(response.data["rows"], [])
+        self.assertEqual(response.data["scope"], "mine")
+
     def test_non_super_admin_cannot_manage_another_requestors_assessment(self):
         ProjectAttributesAccess.objects.create(
             email="maintainer@example.com", migration_intake=True, access_control=True,

backend/api/views/migration_dashboard.py

@@ -2,7 +2,7 @@
 Migration dashboard API views.
 
 Frontend pages: /migration-dashboard, /migration-dashboard/:id
-Also used by /project-dashboard with ?mine=1 (current user's projects only).
+Also used by /project-dashboard with ?mine=1 (personal scope unless access administrator).
 """
 
 import logging
@@ -16,7 +16,7 @@
 from django.utils import timezone
 
 from api.models import ApprovalWorkflow, MigrationIntakeSubmission
-from api.permissions.attributes_access import get_request_email, normalize_email
+from api.permissions.attributes_access import can_access_table, get_request_email, normalize_email
 from api.services.migration_dashboard import (
     build_dashboard_summary,
     serialize_business_case_file,
@@ -40,25 +40,30 @@ def list_projects(request):
     """GET /api/migration-dashboard/projects/ — submitted migration intake overview.
 
     Query params:
-      mine=1 — only projects whose requestor matches the signed-in SSO email
+    mine=1 — current user's projects, or all projects for Access Control administrators
     """
     qs = MigrationIntakeSubmission.objects.all()
+    mine_only = _wants_mine_only(request)
 
-    if _wants_mine_only(request):
+    if mine_only:
         email = get_request_email(request)
         if not email:
             return Response(
                 {"error": "Sign in required. Missing SSO email."},
                 status=status.HTTP_401_UNAUTHORIZED,
             )
-        qs = qs.filter(requestor__iexact=normalize_email(email))
+        if can_access_table(email, "access_control"):
+            mine_only = False
+        else:
+            qs = qs.filter(requestor__iexact=normalize_email(email))
 
     submissions = list(qs)
     rows = [serialize_project_overview(item) for item in submissions]
 
     return Response(
         {
             "count": len(rows),
+            "scope": "mine" if mine_only else "all",
             "summary": build_dashboard_summary(submissions),
             "rows": rows,
         }

backend/api/views/project_artefacts.py

@@ -10,7 +10,7 @@
 
 from api.models import AccessEnablement, ApprovalWorkflow, BusinessCase, MigrationIntakeSubmission, ProjectResources, StakeholderRegistration
 from api.permissions.attributes_access import build_access_snapshot, get_request_email, normalize_email
-from api.services.business_case import online_case_is_approved
+from api.services.business_case import approval_progress, build_business_case, case_status, online_case_is_approved
 from api.services.project_artefacts import (
     AREA_FIELDS, BARRIER_TYPES, EXECUTION_FIELDS, HIRING_STATUSES, HIRING_TYPES,
     HR_FIELDS, IT_ITEMS, LANGUAGES, SYSTEM_CATALOGUE, access_summary, date_value,
@@ -20,6 +20,17 @@
 
 def _serialize(project, record, kind, email):
     source = scope_source(project)
+    business_case = BusinessCase.objects.filter(project=project).first()
+    business_case_source = {"locked": False, "status": "not_started", "population": None}
+    if business_case:
+        _, business_case_scope, _, fingerprint = build_business_case(project, business_case)
+        business_case_status = case_status(business_case, fingerprint, approval_progress(project))
+        locked = business_case_status in {"submitted", "approved"}
+        business_case_source = {
+            "locked": locked,
+            "status": business_case_status,
+            "population": sum(line["finalFte"] or 0 for line in business_case_scope["lines"]) if locked else None,
+        }
     permissions = project_permissions(project, email, kind)
     changed = bool(record and record.source_version != source["version"])
     result = {
@@ -28,6 +39,7 @@ def _serialize(project, record, kind, email):
         "region": project.region, "areas": project.areas, "countries": project.countries,
         "products": project.products,
         "sites": (project.default_location_strategies or []) + (project.custom_location_strategies or []),
+        "businessCase": business_case_source,
         "source": source, "sourceChanged": changed, "permissions": permissions,
         "saved": record is not None, "revision": record.revision if record else 0,
         "updatedAt": record.updated_at.isoformat() if record else "",
@@ -82,7 +94,7 @@ def _resource_rows(payload, record, permissions, action, email):
             value = row.get(field, "")
             normalized[field] = date_value(value, field) if field.endswith("Date") or field.endswith("Doj") else text(value, field)
         if normalized["hiringType"] not in HIRING_TYPES:
-            raise ValueError("Choose External, IJP or Efficiency for each resource.")
+            raise ValueError("Choose Efficiency, Backfill, External or IJP for each resource.")
         if normalized["language"] and normalized["language"] not in LANGUAGES:
             raise ValueError("Choose a language from the catalogue.")
         if normalized["hiringStatus"] not in HIRING_STATUSES + ["Not Applicable"]:
@@ -316,7 +328,7 @@ def resource_projects(request):
             if any(normalize_email(person.get("email")) == email for person in registration.team_members)
         ]
         projects = projects.filter(Q(requestor__iexact=email) | Q(pk__in=member_projects))
-    online = {case.project_id: case for case in BusinessCase.objects.only("project_id", "status", "review_required")}
+    online = {case.project_id: case for case in BusinessCase.objects.select_related("project")}
     from api.views.approval_cycle import _progress
     legacy_progress = {
         workflow.migration_request_id: _progress(workflow)
@@ -326,24 +338,31 @@ def resource_projects(request):
     for project in projects.order_by("-id"):
         source = scope_source(project)
         case = online.get(project.pk)
+        business_case = {"locked": False, "status": "not_started", "population": None}
         if case:
-            approved = case.status == "submitted" and not case.review_required and bool(online_case_is_approved(project))
+            _, business_case_scope, _, fingerprint = build_business_case(project, case)
+            business_case_status = case_status(case, fingerprint, approval_progress(project))
+            business_case["locked"] = business_case_status in {"submitted", "approved"}
+            business_case["status"] = business_case_status
+            business_case["population"] = sum(line["finalFte"] or 0 for line in business_case_scope["lines"]) if business_case["locked"] else None
+            approved = business_case["status"] == "approved"
         else:
             progress = legacy_progress.get(project.migration_request_id)
             approved = bool(project.business_case_submission_date and progress and progress["step"] > progress["seqLen"] and progress["completed"])
         try:
             resource = project.resources
         except ProjectResources.DoesNotExist:
             resource = None
-        population = source["population"]
+        population = business_case["population"]
         rows.append({
             "projectId": project.pk, "projectName": project.project_name,
             "migrationRequestId": project.migration_request_id, "products": project.products,
             "region": project.region, "areas": project.areas,
             "sites": (project.default_location_strategies or []) + (project.custom_location_strategies or []),
             "approvedFte": population if approved else None,
-            "pipelineFte": population if not approved else None,
-            "approvalStatus": "Approved" if approved else "Pipeline",
+            "pipelineFte": population if business_case["locked"] and not approved else None,
+            "approvalStatus": "Approved" if approved else "Pipeline" if business_case["locked"] else "Not locked",
+            "businessCase": business_case,
             "saved": bool(resource),
             "status": ("confirmed" if resource.source_version == source["version"] else "needs_review")
                       if resource and resource.status == "confirmed" else "draft" if resource else "not_started",

backend/api/views/scope_statement.py

@@ -167,7 +167,7 @@ def _serialize_statement(project, statement, email):
             }
         for level in JOB_LEVELS
         for field, label in (
-            ("agreed_fte", "Agreed FTE"),
+            ("agreed_fte", "Migratable FTE (suggested/manual)"),
             ("not_agreed_fte", "Not Agreed FTE"),
             ("final_fte", "Final FTE"),
             ("locked_at", "Locked At"),
@@ -526,8 +526,6 @@ def save_scope_statement(request, project_id):
         if action == "lock":
             if statement.migratable_fte is None or not statement.migratable_fte_confirmed:
                 return Response({"error": "Manually confirm Migratable FTE before locking the page."}, status=400)
-            if not statement.attachments.exists():
-                return Response({"error": "Upload an attachment before locking the page."}, status=400)
             if len(all_lines) != 3 or not statement.scope_text.strip() or any(
                 line.agreed_fte is None or line.not_agreed_fte is None or line.final_fte is None
                 for line in all_lines
@@ -546,8 +544,8 @@ def save_scope_statement(request, project_id):
                 return Response({"error": "Unlock the page and manually confirm Migratable FTE before submitting."}, status=400)
             if not statement.scope_text.strip():
                 return Response({"error": "High-level scope statement is required before submitting."}, status=status.HTTP_400_BAD_REQUEST)
-            if len(all_lines) != 3 or any(line.locked_at is None for line in all_lines) or not statement.attachments.exists():
-                return Response({"error": "Lock the whole page with an attachment before submitting."}, status=status.HTTP_400_BAD_REQUEST)
+            if len(all_lines) != 3 or any(line.locked_at is None for line in all_lines):
+                return Response({"error": "Lock the whole page before submitting."}, status=status.HTTP_400_BAD_REQUEST)
             statement.ambition_fte = Decimal(str(project.fte_number or 0))
             statement.final_project_fte = sum(int(line.final_fte or 0) for line in all_lines)
             if statement.waves and sum(wave["fte"] for wave in statement.waves) != statement.final_project_fte: