chore: release 0.38.5

Author: matteius

CHANGELOG.md

@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.38.5] - 2026-03-30
+
+### Fixed
+- **Send-back stage actions missing from approval workflows** — The visual workflow builder now round-trips the stage-level `allow_send_back` flag, so stages configured as send-back targets persist correctly and the approval UI once again shows **Send Back for Correction** where applicable. Older saved visual workflow JSON is backfilled from `WorkflowStage.allow_send_back` to avoid silently losing the button on existing workflows.
+- **Submission PDF visibility/privacy alignment** — Reviewer-group members are now treated like other elevated users for `post_approval` PDF access, and submitter-only PDF views now respect `WorkflowDefinition.hide_approval_history` so approval-step details are hidden consistently in generated PDFs.
+
 ## [0.38.0] - 2026-03-27
 
 ### Added

django_forms_workflows/static/django_forms_workflows/js/workflow-builder.js

@@ -335,6 +335,7 @@ class WorkflowBuilder {
                     order: 1,
                     approval_logic: 'all',
                     requires_manager_approval: false,
+                    allow_send_back: false,
                     approve_label: '',
                     approval_groups: [],
                 };
@@ -542,6 +543,18 @@ class WorkflowBuilder {
                 </div>
             </div>
 
+            <div class="mb-3">
+                <div class="form-check form-switch">
+                    <input class="form-check-input" type="checkbox" id="stage_allow_send_back_${node.id}"
+                           name="allow_send_back" ${data.allow_send_back ? 'checked' : ''}
+                           onchange="workflowBuilder.updateStageConfig('${node.id}')">
+                    <label class="form-check-label" for="stage_allow_send_back_${node.id}">
+                        <i class="bi bi-arrow-return-left"></i> <strong>Allow Send Back to This Stage</strong>
+                    </label>
+                </div>
+                <small class="text-muted">Later stages can return submissions here for correction without rejecting the workflow.</small>
+            </div>
+
             <hr />
 
             <div class="mb-3">
@@ -1110,6 +1123,7 @@ class WorkflowBuilder {
         node.data.order = parseInt(container.querySelector('input[name="order"]').value) || 1;
         node.data.approve_label = container.querySelector('input[name="approve_label"]').value;
         node.data.requires_manager_approval = container.querySelector(`#stage_requires_manager_${nodeId}`).checked;
+        node.data.allow_send_back = container.querySelector(`#stage_allow_send_back_${nodeId}`).checked;
 
         const groupSelect = container.querySelector(`#stage_groups_${nodeId}`);
         node.data.approval_groups = Array.from(groupSelect.selectedOptions).map(opt => ({
@@ -1328,6 +1342,7 @@ class WorkflowBuilder {
             case 'stage':
                 const stageParts = [];
                 if (node.data.requires_manager_approval) stageParts.push('Manager');
+                if (node.data.allow_send_back) stageParts.push('Send Back target');
                 if (node.data.approval_groups && node.data.approval_groups.length > 0) {
                     const gc = node.data.approval_groups.length;
                     stageParts.push(`${gc} group${gc > 1 ? 's' : ''} (${node.data.approval_logic || 'all'})`);

django_forms_workflows/templates/django_forms_workflows/submission_pdf.html

@@ -259,6 +259,7 @@ <h3 style="margin-top: 20px;">Attachments</h3>
 </ul>
 {% endif %}
 
+{% if not hide_approval_history %}
 {% for section in approval_step_sections %}
 <div class="step-section-header">
     <span class="step-name-cell">{{ section.step_name }}</span>
@@ -291,6 +292,7 @@ <h3 style="margin-top: 20px;">Attachments</h3>
 </table>
 {% endif %}
 {% endfor %}
+{% endif %}
 
 </body>
 </html>

django_forms_workflows/views.py

@@ -1923,12 +1923,15 @@ def submission_pdf(request, submission_id):
     form_def = submission.form_definition
 
     # --- permission check (same as submission_detail) ---
+    is_reviewer = request.user.groups.filter(
+        id__in=form_def.reviewer_groups.all()
+    ).exists()
     can_view = (
         submission.submitter == request.user
         or request.user.is_superuser
         or user_can_approve(request.user, submission)
         or request.user.groups.filter(id__in=form_def.admin_groups.all()).exists()
-        or request.user.groups.filter(id__in=form_def.reviewer_groups.all()).exists()
+        or is_reviewer
     )
     if not can_view:
         return HttpResponseForbidden(
@@ -1941,18 +1944,32 @@ def submission_pdf(request, submission_id):
         return HttpResponseForbidden("PDF generation is not enabled for this form.")
 
     if pdf_setting == "post_approval" and submission.status != "approved":
-        # Approvers, admins, and superusers may download pending submissions.
-        # Only the submitter themselves must wait until the form is approved.
+        # Approvers, admins, reviewers, and superusers may download pending
+        # submissions.  Only the submitter themselves must wait until approved.
         is_elevated = (
             request.user.is_superuser
             or user_can_approve(request.user, submission)
             or request.user.groups.filter(id__in=form_def.admin_groups.all()).exists()
+            or is_reviewer
         )
         if not is_elevated:
             return HttpResponseForbidden(
                 "PDF is only available after the submission has been approved."
             )
 
+    # --- privacy: mirror hide_approval_history logic from submission_detail ---
+    workflow = getattr(form_def, "workflow", None)
+    is_submitter_only = (
+        submission.submitter == request.user
+        and not request.user.is_superuser
+        and not user_can_approve(request.user, submission)
+        and not request.user.groups.filter(id__in=form_def.admin_groups.all()).exists()
+        and not is_reviewer
+    )
+    hide_approval_history = bool(
+        workflow and workflow.hide_approval_history and is_submitter_only
+    )
+
     # --- build width-aware row groups for PDF layout ---
     pdf_rows = _build_pdf_rows(submission)
     approval_step_sections = _build_approval_step_sections(submission)
@@ -1967,6 +1984,7 @@ def submission_pdf(request, submission_id):
             "form_def": form_def,
             "pdf_rows": pdf_rows,
             "approval_step_sections": approval_step_sections,
+            "hide_approval_history": hide_approval_history,
             "resolved_attachments": _resolve_attachments(submission.attachments),
             "request": request,
         },

django_forms_workflows/workflow_builder_views.py

@@ -166,11 +166,24 @@ def convert_workflow_to_visual(workflow, form_definition):
 
     Reads WorkflowStage records to build stage nodes.
     """
+    stage_defaults = {
+        stage.id: {"allow_send_back": stage.allow_send_back}
+        for stage in workflow.stages.all()
+    }
+
     # Check if visual workflow data exists AND has the correct format (nodes array)
     if workflow.visual_workflow_data:
         visual_data = workflow.visual_workflow_data
         # Check if it has the new format with nodes array
         if isinstance(visual_data, dict) and "nodes" in visual_data:
+            for node in visual_data.get("nodes", []):
+                if node.get("type") != "stage":
+                    continue
+                stage_id = node.get("data", {}).get("stage_id")
+                defaults = stage_defaults.get(stage_id)
+                if defaults:
+                    for key, value in defaults.items():
+                        node.setdefault("data", {}).setdefault(key, value)
             logger.info("Loading saved visual workflow data (new format)")
             return visual_data
         # Old format (e.g., stages array) - regenerate
@@ -295,6 +308,7 @@ def convert_workflow_to_visual(workflow, form_definition):
                         "order": stage.order,
                         "approval_logic": stage.approval_logic,
                         "requires_manager_approval": stage.requires_manager_approval,
+                        "allow_send_back": stage.allow_send_back,
                         "approve_label": stage.approve_label or "",
                         "approval_groups": [
                             {"id": g.id, "name": g.name} for g in stage_groups
@@ -326,6 +340,7 @@ def convert_workflow_to_visual(workflow, form_definition):
                             "order": stage.order,
                             "approval_logic": stage.approval_logic,
                             "requires_manager_approval": stage.requires_manager_approval,
+                            "allow_send_back": stage.allow_send_back,
                             "approve_label": stage.approve_label or "",
                             "approval_groups": [
                                 {"id": g.id, "name": g.name} for g in stage_groups
@@ -550,6 +565,7 @@ def convert_visual_to_workflow(workflow_data, form_definition):
             "order": sdata.get("order", idx),
             "approval_logic": sdata.get("approval_logic", "all"),
             "requires_manager_approval": sdata.get("requires_manager_approval", False),
+            "allow_send_back": sdata.get("allow_send_back", False),
             "approve_label": sdata.get("approve_label", ""),
         }
 

pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "django-forms-workflows"
-version = "0.38.4"
+version = "0.38.5"
 description = "Enterprise-grade, database-driven form builder with approval workflows and external data integration"
 license = "LGPL-3.0-only"
 readme = "README.md"

tests/test_builders.py

@@ -52,6 +52,10 @@ def test_generates_layout_with_stages(
         self, staged_workflow, form_definition, approval_group, second_approval_group
     ):
         """Staged workflow generates stage nodes (not legacy approval_config)."""
+        first_stage = staged_workflow.stages.order_by("order").first()
+        first_stage.allow_send_back = True
+        first_stage.save(update_fields=["allow_send_back"])
+
         result = convert_workflow_to_visual(staged_workflow, form_definition)
         types = [n["type"] for n in result["nodes"]]
 
@@ -67,6 +71,33 @@ def test_generates_layout_with_stages(
         assert len(stage_nodes) == 2
         assert stage_nodes[0]["data"]["name"] == "Manager Review"
         assert stage_nodes[1]["data"]["name"] == "Finance Review"
+        assert stage_nodes[0]["data"]["allow_send_back"] is True
+
+    def test_backfills_send_back_flag_from_saved_visual_data(
+        self, staged_workflow, form_definition
+    ):
+        stage = staged_workflow.stages.order_by("order").first()
+        stage.allow_send_back = True
+        stage.save(update_fields=["allow_send_back"])
+        staged_workflow.visual_workflow_data = {
+            "nodes": [
+                {
+                    "id": "node_1",
+                    "type": "stage",
+                    "data": {
+                        "stage_id": stage.id,
+                        "name": stage.name,
+                        "order": stage.order,
+                    },
+                }
+            ],
+            "connections": [],
+        }
+        staged_workflow.save(update_fields=["visual_workflow_data"])
+
+        result = convert_workflow_to_visual(staged_workflow, form_definition)
+
+        assert result["nodes"][0]["data"]["allow_send_back"] is True
 
     def test_workflow_with_no_stages_has_no_stage_nodes(self, form_definition, db):
         """Workflow without stages produces no stage nodes."""
@@ -116,6 +147,7 @@ def test_creates_stages(self, form_definition, approval_group):
                     "order": 1,
                     "approval_logic": "all",
                     "requires_manager_approval": True,
+                    "allow_send_back": True,
                     "approve_label": "Sign Off",
                     "approval_groups": [
                         {"id": approval_group.id, "name": approval_group.name}
@@ -130,6 +162,7 @@ def test_creates_stages(self, form_definition, approval_group):
         assert stages[0].name == "Review"
         assert stages[0].approval_logic == "all"
         assert stages[0].requires_manager_approval is True
+        assert stages[0].allow_send_back is True
         assert stages[0].approve_label == "Sign Off"
         assert list(stages[0].approval_groups.values_list("id", flat=True)) == [
             approval_group.id
@@ -253,6 +286,7 @@ def test_save_creates_stages(
                             "order": 1,
                             "approval_logic": "all",
                             "requires_manager_approval": False,
+                            "allow_send_back": True,
                             "approve_label": "Confirm",
                             "approval_groups": [
                                 {
@@ -279,6 +313,7 @@ def test_save_creates_stages(
         stages = list(wf.stages.order_by("order"))
         assert len(stages) == 1
         assert stages[0].name == "Sign Off"
+        assert stages[0].allow_send_back is True
 
 
 # ── Form builder view tests ─────────────────────────────────────────────────

tests/test_views.py

@@ -260,6 +260,78 @@ def test_approval_step_sections_in_context(
         resp = client.get(url)
         assert "approval_step_sections" in resp.context
 
+    def test_send_back_option_shown_for_prior_send_back_stage(
+        self,
+        client,
+        form_with_fields,
+        user,
+        approver_user,
+        approval_group,
+        second_approval_group,
+    ):
+        from django_forms_workflows.models import WorkflowDefinition, WorkflowStage
+
+        wf = WorkflowDefinition.objects.create(
+            form_definition=form_with_fields, requires_approval=True
+        )
+        stage1 = WorkflowStage.objects.create(
+            workflow=wf,
+            name="Manager Review",
+            order=1,
+            approval_logic="all",
+            allow_send_back=True,
+        )
+        stage1.approval_groups.add(approval_group)
+        stage2 = WorkflowStage.objects.create(
+            workflow=wf,
+            name="Finance Review",
+            order=2,
+            approval_logic="all",
+        )
+        stage2.approval_groups.add(second_approval_group)
+
+        sub = FormSubmission.objects.create(
+            form_definition=form_with_fields,
+            submitter=user,
+            form_data={
+                "full_name": "Test User",
+                "email": "test@example.com",
+                "department": "it",
+                "amount": "500.00",
+                "notes": "Review please",
+            },
+            status="pending_approval",
+        )
+
+        ApprovalTask.objects.create(
+            submission=sub,
+            assigned_group=approval_group,
+            step_name="Manager Review",
+            status="approved",
+            stage_number=1,
+            workflow_stage=stage1,
+        )
+        task = ApprovalTask.objects.create(
+            submission=sub,
+            assigned_group=second_approval_group,
+            step_name="Finance Review",
+            status="pending",
+            stage_number=2,
+            workflow_stage=stage2,
+        )
+
+        approver_user.groups.add(second_approval_group)
+        client.force_login(approver_user)
+        url = reverse("forms_workflows:approve_submission", args=[task.pk])
+        resp = client.get(url)
+
+        assert resp.status_code == 200
+        assert "send_back_stages" in resp.context
+        assert [stage.name for stage in resp.context["send_back_stages"]] == [
+            "Manager Review"
+        ]
+        assert b"Send Back for Correction" in resp.content
+
 
 # ── save_draft ──────────────────────────────────────────────────────────