django-forms-workflows 0.36.2__tar.gz → 0.37.0__tar.gz

{django_forms_workflows-0.36.2 → django_forms_workflows-0.37.0}/CHANGELOG.md

@@ -7,6 +7,40 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.37.0] - 2026-03-26
+
+### Added
+- **`reviewer_groups` permission level on `FormDefinition`** — a new M2M field that grants named groups read-only access to all submissions and their full approval history for a form, without the management capabilities of `admin_groups`.
+  - Members of a `reviewer_groups` group will see all submitted/pending/approved/rejected/withdrawn submissions for that form under **My Submissions** (alongside their own), so they can navigate to them without needing a direct URL.
+  - The full approval history is always visible to reviewers even when `hide_approval_history` is enabled on the workflow (matching the behaviour for approvers and admins).
+  - Access is enforced consistently across `submission_detail`, `sub_workflow_detail`, `submission_pdf`, `bulk_export_submissions`, `bulk_export_submissions_pdf`, and the `user_can_view_submission` utility.
+  - The field is exposed in Django Admin under the **Access Control** fieldset with a horizontal filter widget, and is preserved when cloning a form.
+  - Migration `0064_add_reviewer_groups` adds the underlying join table.
+
+## [0.36.5] - 2026-03-26
+
+### Fixed
+- **`email_to_field` / `email_cc_field` now support comma-separated addresses** — `EmailActionHandler._get_recipients` and `_get_cc_list` previously appended the raw field value as a single address, silently discarding all but the first recipient when multiple addresses were entered. Both methods now split on commas and validate each address individually, so a faculty-emails field with `prof1@sjcme.edu, prof2@sjcme.edu` correctly delivers to all listed recipients.
+
+## [0.36.4] - 2026-03-26
+
+### Added
+- **Dynamic dropdown choices from database** — select, multiselect, multiselect_list, radio, and checkboxes fields can now have their options populated live from any SQL query defined in `FORMS_WORKFLOWS_DATABASE_QUERIES`. Mark a query with `"return_choices": True` (and no user parameter) to return multiple rows; each row's first column becomes the option value and the second column (if present) becomes the display label. Wire it up by pointing the field's PrefillSource at the query key — the stored `choices` JSON is used as a fallback if the DB is unavailable.
+- `DatabaseDataSource.execute_choices_query(query_key)` — new method that executes a choices query without a user parameter and returns `[(value, label), ...]`.
+- `_get_choices_from_prefill_source(field_def)` — new helper on both form classes that detects `return_choices` queries and calls `execute_choices_query`; returns `None` when not applicable so callers fall back to stored choices.
+- `execute_custom_query` now warns and returns `None` if called on a `return_choices` query, preventing accidental single-value use.
+
+## [0.36.3] - 2026-03-26
+
+### Fixed
+- **Cross-instance sync missing newer fields** — `sync_api.serialize_form` and `_serialize_field` were not including several fields added after the serializer was first written, meaning push/pull/diff silently dropped their values on the receiving instance:
+  - `FormDefinition.allow_batch_import` (spreadsheet/Excel batch upload toggle, migration 0062)
+  - `FormDefinition.is_listed` (hide-from-list-page flag, migration 0051)
+  - `FormDefinition.allow_resubmit` (re-submission from rejected/withdrawn, migration 0024)
+  - `FormDefinition.api_enabled` (REST API exposure flag, migration 0063)
+  - `FormField.formula` (formula expression for Calculated field types, migration 0056)
+  All five fields are now serialized on export and restored on import. The diff summary in `diff_views._build_summary` is also updated to detect changes to all four FormDefinition flags.
+
 ## [0.33.1] - 2026-03-23
 
 ### Fixed

{django_forms_workflows-0.36.2 → django_forms_workflows-0.37.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: django-forms-workflows
-Version: 0.36.2
+Version: 0.37.0
 Summary: Enterprise-grade, database-driven form builder with approval workflows and external data integration
 License: LGPL-3.0-only
 License-File: LICENSE

{django_forms_workflows-0.36.2 → django_forms_workflows-0.37.0}/django_forms_workflows/admin.py

@@ -398,7 +398,12 @@ class FormDefinitionAdmin(nested_admin.NestedModelAdmin):
     prepopulated_fields = {"slug": ("name",)}
     readonly_fields = ("created_at", "updated_at", "created_by")
     inlines = [FormFieldInline, WorkflowDefinitionInline]
-    filter_horizontal = ("submit_groups", "view_groups", "admin_groups")
+    filter_horizontal = (
+        "submit_groups",
+        "view_groups",
+        "admin_groups",
+        "reviewer_groups",
+    )
     change_form_template = "admin/django_forms_workflows/formdef_change_form.html"
     actions = ["clone_forms", "diff_forms", "export_as_json"]
 
@@ -424,6 +429,7 @@ class FormDefinitionAdmin(nested_admin.NestedModelAdmin):
                     "submit_groups",
                     "view_groups",
                     "admin_groups",
+                    "reviewer_groups",
                 ),
             },
         ),
@@ -614,6 +620,7 @@ class FormDefinitionAdmin(nested_admin.NestedModelAdmin):
                     cloned_form.submit_groups.set(form.submit_groups.all())
                     cloned_form.view_groups.set(form.view_groups.all())
                     cloned_form.admin_groups.set(form.admin_groups.all())
+                    cloned_form.reviewer_groups.set(form.reviewer_groups.all())
 
                     # Clone workflows, stages, and stage approval groups
                     for wf in form.workflows.all():

{django_forms_workflows-0.36.2 → django_forms_workflows-0.37.0}/django_forms_workflows/data_sources/database_source.py

@@ -428,6 +428,16 @@ class DatabaseDataSource(DataSource):
                 )
                 return None
 
+            # Choices queries (return_choices=True) return multiple rows for
+            # populating dropdown options and require no user parameter.
+            # Use execute_choices_query() for those instead.
+            if query_config.get("return_choices"):
+                logger.warning(
+                    f"Database query '{query_key}' has return_choices=True. "
+                    "Use execute_choices_query() to get dropdown options."
+                )
+                return None
+
             # Get user's lookup value
             user_id = self._get_user_id(user, user_field)
             if not user_id:
@@ -461,6 +471,76 @@ class DatabaseDataSource(DataSource):
             logger.error(f"Error executing custom query '{query_key}': {e}")
             return None
 
+    def execute_choices_query(self, query_key: str) -> list[tuple] | None:
+        """
+        Execute a reference-data query and return all rows as (value, label) tuples
+        for populating dropdown / select / radio field options.
+
+        Unlike execute_custom_query(), this method requires no user parameter and
+        always fetches all rows. The query config must have ``return_choices: True``.
+
+        If the query returns two columns, the first is used as the option value and
+        the second as the display label. If only one column is returned, both value
+        and label are set to that column's value.
+
+        Args:
+            query_key: Key from FORMS_WORKFLOWS_DATABASE_QUERIES setting.
+
+        Returns:
+            List of (value, label) tuples, or None on configuration/query error.
+        """
+        try:
+            queries = getattr(settings, "FORMS_WORKFLOWS_DATABASE_QUERIES", {})
+            if query_key not in queries:
+                logger.error(
+                    f"Database query key '{query_key}' not found in "
+                    "FORMS_WORKFLOWS_DATABASE_QUERIES setting"
+                )
+                return None
+
+            query_config = queries[query_key]
+
+            if not query_config.get("return_choices"):
+                logger.error(
+                    f"Database query '{query_key}' does not have return_choices=True. "
+                    "Use execute_custom_query() for single-value prefill queries."
+                )
+                return None
+
+            query_text = query_config.get("query")
+            db_alias = query_config.get("db_alias")
+
+            if not query_text or not db_alias:
+                logger.error(
+                    f"Database choices query '{query_key}' missing 'query' or 'db_alias'"
+                )
+                return None
+
+            databases = getattr(settings, "DATABASES", {})
+            if db_alias not in databases:
+                logger.error(f"Database alias '{db_alias}' not configured")
+                return None
+
+            with connections[db_alias].cursor() as cursor:
+                cursor.execute(query_text)
+                rows = cursor.fetchall()
+
+            results = []
+            for row in rows:
+                if len(row) >= 2:
+                    value = str(row[0] or "").strip()
+                    label = str(row[1] or "").strip()
+                else:
+                    value = label = str(row[0] or "").strip()
+                if value:
+                    results.append((value, label))
+
+            return results
+
+        except Exception as e:
+            logger.error(f"Error executing choices query '{query_key}': {e}")
+            return None
+
     def is_available(self) -> bool:
         """
         Check if database source is configured.

{django_forms_workflows-0.36.2 → django_forms_workflows-0.37.0}/django_forms_workflows/diff_views.py

@@ -150,13 +150,17 @@ def _build_summary(forms_data):
             "description",
             "instructions",
             "is_active",
+            "is_listed",
             "allow_save_draft",
             "allow_withdrawal",
+            "allow_resubmit",
+            "allow_batch_import",
             "requires_login",
             "enable_multi_step",
             "enable_auto_save",
             "auto_save_interval",
             "pdf_generation",
+            "api_enabled",
         ]
         for key in meta_keys:
             if b_form.get(key) != o_form.get(key):

{django_forms_workflows-0.36.2 → django_forms_workflows-0.37.0}/django_forms_workflows/forms.py

@@ -276,6 +276,31 @@ class DynamicForm(forms.Form):
 
         return []
 
+    def _get_choices_from_prefill_source(self, field_def):
+        """
+        Return a list of (value, label) tuples from a database choices query when the
+        field's PrefillSource points to a query with ``return_choices=True``.
+
+        Returns None if the field has no such source (so the caller can fall back to
+        the stored ``field_def.choices``). Returns [] if the query ran but was empty.
+        """
+        prefill_key = field_def.get_prefill_source_key()
+        if not prefill_key or not prefill_key.startswith("dbquery."):
+            return None
+
+        query_key = prefill_key[len("dbquery.") :]
+
+        from django.conf import settings
+
+        queries = getattr(settings, "FORMS_WORKFLOWS_DATABASE_QUERIES", {})
+        if not queries.get(query_key, {}).get("return_choices"):
+            return None
+
+        from .data_sources import DatabaseDataSource
+
+        source = DatabaseDataSource()
+        return source.execute_choices_query(query_key)
+
     def add_field(self, field_def, initial_data):
         """Add a field to the form based on field definition"""
 
@@ -402,19 +427,34 @@ class DynamicForm(forms.Form):
             self.fields[field_def.field_name] = forms.URLField(**field_args)
 
         elif field_def.field_type == "select":
-            choices = [("", "-- Select --")] + self._parse_choices(field_def.choices)
+            _db_choices = self._get_choices_from_prefill_source(field_def)
+            choices = [("", "-- Select --")] + (
+                _db_choices
+                if _db_choices is not None
+                else self._parse_choices(field_def.choices)
+            )
             self.fields[field_def.field_name] = forms.ChoiceField(
                 choices=choices, **field_args
             )
 
         elif field_def.field_type == "multiselect":
-            choices = self._parse_choices(field_def.choices)
+            _db_choices = self._get_choices_from_prefill_source(field_def)
+            choices = (
+                _db_choices
+                if _db_choices is not None
+                else self._parse_choices(field_def.choices)
+            )
             self.fields[field_def.field_name] = forms.MultipleChoiceField(
                 choices=choices, widget=forms.CheckboxSelectMultiple, **field_args
             )
 
         elif field_def.field_type == "multiselect_list":
-            choices = self._parse_choices(field_def.choices)
+            _db_choices = self._get_choices_from_prefill_source(field_def)
+            choices = (
+                _db_choices
+                if _db_choices is not None
+                else self._parse_choices(field_def.choices)
+            )
             self.fields[field_def.field_name] = forms.MultipleChoiceField(
                 choices=choices,
                 widget=forms.SelectMultiple(attrs={"class": "form-select"}),
@@ -422,7 +462,12 @@ class DynamicForm(forms.Form):
             )
 
         elif field_def.field_type == "radio":
-            choices = self._parse_choices(field_def.choices)
+            _db_choices = self._get_choices_from_prefill_source(field_def)
+            choices = (
+                _db_choices
+                if _db_choices is not None
+                else self._parse_choices(field_def.choices)
+            )
             self.fields[field_def.field_name] = forms.ChoiceField(
                 choices=choices, widget=forms.RadioSelect, **field_args
             )
@@ -436,7 +481,12 @@ class DynamicForm(forms.Form):
             )
 
         elif field_def.field_type == "checkboxes":
-            choices = self._parse_choices(field_def.choices)
+            _db_choices = self._get_choices_from_prefill_source(field_def)
+            choices = (
+                _db_choices
+                if _db_choices is not None
+                else self._parse_choices(field_def.choices)
+            )
             self.fields[field_def.field_name] = forms.MultipleChoiceField(
                 choices=choices,
                 widget=forms.CheckboxSelectMultiple,
@@ -1057,7 +1107,12 @@ class ApprovalStepForm(forms.Form):
             self.fields[field_def.field_name] = forms.EmailField(**field_args)
 
         elif field_def.field_type == "select":
-            choices = [("", "-- Select --")] + self._parse_choices(field_def.choices)
+            _db_choices = self._get_choices_from_prefill_source(field_def)
+            choices = [("", "-- Select --")] + (
+                _db_choices
+                if _db_choices is not None
+                else self._parse_choices(field_def.choices)
+            )
             if widget_attrs:
                 field_args["widget"] = forms.Select(attrs=widget_attrs)
             self.fields[field_def.field_name] = forms.ChoiceField(
@@ -1065,7 +1120,12 @@ class ApprovalStepForm(forms.Form):
             )
 
         elif field_def.field_type == "multiselect":
-            choices = self._parse_choices(field_def.choices)
+            _db_choices = self._get_choices_from_prefill_source(field_def)
+            choices = (
+                _db_choices
+                if _db_choices is not None
+                else self._parse_choices(field_def.choices)
+            )
             self.fields[field_def.field_name] = forms.MultipleChoiceField(
                 choices=choices,
                 widget=forms.CheckboxSelectMultiple,
@@ -1073,7 +1133,12 @@ class ApprovalStepForm(forms.Form):
             )
 
         elif field_def.field_type == "multiselect_list":
-            choices = self._parse_choices(field_def.choices)
+            _db_choices = self._get_choices_from_prefill_source(field_def)
+            choices = (
+                _db_choices
+                if _db_choices is not None
+                else self._parse_choices(field_def.choices)
+            )
             self.fields[field_def.field_name] = forms.MultipleChoiceField(
                 choices=choices,
                 widget=forms.SelectMultiple(attrs={"class": "form-select"}),
@@ -1081,7 +1146,12 @@ class ApprovalStepForm(forms.Form):
             )
 
         elif field_def.field_type == "radio":
-            choices = self._parse_choices(field_def.choices)
+            _db_choices = self._get_choices_from_prefill_source(field_def)
+            choices = (
+                _db_choices
+                if _db_choices is not None
+                else self._parse_choices(field_def.choices)
+            )
             self.fields[field_def.field_name] = forms.ChoiceField(
                 choices=choices,
                 widget=forms.RadioSelect(attrs=widget_attrs),
@@ -1195,6 +1265,29 @@ class ApprovalStepForm(forms.Form):
             return [(c.strip(), c.strip()) for c in choices.split(",") if c.strip()]
         return []
 
+    def _get_choices_from_prefill_source(self, field_def):
+        """
+        Return (value, label) tuples from a database choices query when the field's
+        PrefillSource points to a query with ``return_choices=True``, or None if the
+        field has no such source (so the caller falls back to stored choices).
+        """
+        prefill_key = field_def.get_prefill_source_key()
+        if not prefill_key or not prefill_key.startswith("dbquery."):
+            return None
+
+        query_key = prefill_key[len("dbquery.") :]
+
+        from django.conf import settings
+
+        queries = getattr(settings, "FORMS_WORKFLOWS_DATABASE_QUERIES", {})
+        if not queries.get(query_key, {}).get("return_choices"):
+            return None
+
+        from .data_sources import DatabaseDataSource
+
+        source = DatabaseDataSource()
+        return source.execute_choices_query(query_key)
+
     def _build_layout_fields(self, field_defs):
         """Convert a list of field definitions into crispy layout elements,
         respecting half / third / fourth width settings."""

{django_forms_workflows-0.36.2 → django_forms_workflows-0.37.0}/django_forms_workflows/handlers/email_handler.py

@@ -95,11 +95,14 @@ class EmailHandler(BaseActionHandler):
             ]
             recipients.extend(static_emails)
 
-        # Add email from form field
+        # Add email(s) from form field — supports comma-separated addresses
         if self.action.email_to_field:
             field_email = self.get_form_field_value(self.action.email_to_field)
-            if field_email and isinstance(field_email, str) and "@" in field_email:
-                recipients.append(field_email.strip())
+            if field_email and isinstance(field_email, str):
+                for addr in field_email.split(","):
+                    addr = addr.strip()
+                    if addr and "@" in addr:
+                        recipients.append(addr)
 
         # Remove duplicates while preserving order
         seen = set()
@@ -127,11 +130,14 @@ class EmailHandler(BaseActionHandler):
             ]
             cc_list.extend(static_cc)
 
-        # Add CC from form field
+        # Add CC email(s) from form field — supports comma-separated addresses
         if self.action.email_cc_field:
             field_cc = self.get_form_field_value(self.action.email_cc_field)
-            if field_cc and isinstance(field_cc, str) and "@" in field_cc:
-                cc_list.append(field_cc.strip())
+            if field_cc and isinstance(field_cc, str):
+                for addr in field_cc.split(","):
+                    addr = addr.strip()
+                    if addr and "@" in addr:
+                        cc_list.append(addr)
 
         # Remove duplicates
         seen = set()

django_forms_workflows-0.37.0/django_forms_workflows/migrations/0064_add_reviewer_groups.py

@@ -0,0 +1,27 @@
+import django.db.models.deletion
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("django_forms_workflows", "0063_formdefinition_api_enabled_apitoken"),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="formdefinition",
+            name="reviewer_groups",
+            field=models.ManyToManyField(
+                blank=True,
+                help_text=(
+                    "Groups that can view all submissions and full approval history "
+                    "for this form. Unlike admin groups, reviewers cannot manage the "
+                    "form itself."
+                ),
+                related_name="can_review_forms",
+                to="auth.group",
+            ),
+        ),
+    ]
+

{django_forms_workflows-0.36.2 → django_forms_workflows-0.37.0}/django_forms_workflows/models.py

@@ -156,6 +156,15 @@ class FormDefinition(models.Model):
         blank=True,
         help_text="Groups that can view all submissions",
     )
+    reviewer_groups = models.ManyToManyField(
+        Group,
+        related_name="can_review_forms",
+        blank=True,
+        help_text=(
+            "Groups that can view all submissions and full approval history for this form. "
+            "Unlike admin groups, reviewers cannot manage the form itself."
+        ),
+    )
 
     # Behavior
     allow_save_draft = models.BooleanField(

{django_forms_workflows-0.36.2 → django_forms_workflows-0.37.0}/django_forms_workflows/sync_api.py

@@ -216,6 +216,7 @@ def _serialize_field(field):
         "choices": field.choices,
         "prefill_source_config": _serialize_prefill_source(field.prefill_source_config),
         "default_value": field.default_value,
+        "formula": field.formula,
         "conditional_rules": field.conditional_rules,
         "validation_rules": field.validation_rules,
         "field_dependencies": field.field_dependencies,
@@ -373,18 +374,22 @@ def serialize_form(form_definition):
             "description": form_definition.description,
             "instructions": form_definition.instructions,
             "is_active": form_definition.is_active,
+            "is_listed": form_definition.is_listed,
             "version": form_definition.version,
             "submit_groups": _group_names(form_definition.submit_groups),
             "view_groups": _group_names(form_definition.view_groups),
             "admin_groups": _group_names(form_definition.admin_groups),
             "allow_save_draft": form_definition.allow_save_draft,
             "allow_withdrawal": form_definition.allow_withdrawal,
+            "allow_resubmit": form_definition.allow_resubmit,
+            "allow_batch_import": form_definition.allow_batch_import,
             "requires_login": form_definition.requires_login,
             "enable_multi_step": form_definition.enable_multi_step,
             "form_steps": form_definition.form_steps,
             "enable_auto_save": form_definition.enable_auto_save,
             "auto_save_interval": form_definition.auto_save_interval,
             "pdf_generation": form_definition.pdf_generation,
+            "api_enabled": form_definition.api_enabled,
         },
         "fields": [
             _serialize_field(f) for f in form_definition.fields.all().order_by("order")
@@ -521,16 +526,20 @@ def import_form(form_data, conflict="update", category_cache=None):
         "description": fd.get("description", ""),
         "instructions": fd.get("instructions", ""),
         "is_active": fd.get("is_active", True),
+        "is_listed": fd.get("is_listed", True),
         "version": fd.get("version", 1),
         "category": category,
         "allow_save_draft": fd.get("allow_save_draft", False),
         "allow_withdrawal": fd.get("allow_withdrawal", False),
+        "allow_resubmit": fd.get("allow_resubmit", False),
+        "allow_batch_import": fd.get("allow_batch_import", False),
         "requires_login": fd.get("requires_login", True),
         "enable_multi_step": fd.get("enable_multi_step", False),
         "form_steps": fd.get("form_steps"),
         "enable_auto_save": fd.get("enable_auto_save", False),
         "auto_save_interval": fd.get("auto_save_interval", 30),
         "pdf_generation": fd.get("pdf_generation", False),
+        "api_enabled": fd.get("api_enabled", False),
     }
 
     form_obj, created = FormDefinition.objects.update_or_create(

{django_forms_workflows-0.36.2 → django_forms_workflows-0.37.0}/django_forms_workflows/utils.py

@@ -264,6 +264,12 @@ def user_can_view_submission(user, submission: FormSubmission) -> bool:
     ).exists():
         return True
 
+    # Reviewers can view submissions and approval history
+    if user.groups.filter(
+        id__in=submission.form_definition.reviewer_groups.all()
+    ).exists():
+        return True
+
     return False
 
 

{django_forms_workflows-0.36.2 → django_forms_workflows-0.37.0}/django_forms_workflows/views.py

@@ -417,7 +417,25 @@ def my_submissions(request):
     ``category_counts`` list so the UI can render a filter-pill bar showing
     how many submissions belong to each category.
     """
-    base_submissions = FormSubmission.objects.filter(submitter=request.user)
+    # Include submissions the user owns OR submissions for forms they can review.
+    reviewer_form_ids = (
+        FormDefinition.objects.filter(reviewer_groups__in=request.user.groups.all())
+        .values_list("id", flat=True)
+        .distinct()
+    )
+    base_submissions = FormSubmission.objects.filter(
+        models.Q(submitter=request.user)
+        | models.Q(
+            form_definition__in=reviewer_form_ids,
+            status__in=[
+                "submitted",
+                "pending_approval",
+                "approved",
+                "rejected",
+                "withdrawn",
+            ],
+        )
+    ).distinct()
 
     # --- Category counts (for the filter bar) ---
     raw_counts = (
@@ -542,14 +560,17 @@ def submission_detail(request, submission_id):
     """View submission details"""
     submission = get_object_or_404(FormSubmission, id=submission_id)
 
-    # Check permissions - user must be submitter, approver, or admin
+    # Check permissions - user must be submitter, approver, admin, or reviewer
+    form_def_early = submission.form_definition
+    is_reviewer = request.user.groups.filter(
+        id__in=form_def_early.reviewer_groups.all()
+    ).exists()
     can_view = (
         submission.submitter == request.user
         or request.user.is_superuser
         or user_can_approve(request.user, submission)
-        or request.user.groups.filter(
-            id__in=submission.form_definition.admin_groups.all()
-        ).exists()
+        or request.user.groups.filter(id__in=form_def_early.admin_groups.all()).exists()
+        or is_reviewer
     )
 
     if not can_view:
@@ -743,15 +764,17 @@ def submission_detail(request, submission_id):
         request.user.is_superuser
         or user_can_approve(request.user, submission)
         or request.user.groups.filter(id__in=form_def.admin_groups.all()).exists()
+        or is_reviewer
     )
 
     # Privacy: hide approval history from the submitter when configured.
-    # Approvers and admins always see the full history.
+    # Approvers, admins, and reviewers always see the full history.
     is_submitter_only = (
         submission.submitter == request.user
         and not request.user.is_superuser
         and not user_can_approve(request.user, submission)
         and not request.user.groups.filter(id__in=form_def.admin_groups.all()).exists()
+        and not is_reviewer
     )
     hide_approval_history = bool(
         workflow and workflow.hide_approval_history and is_submitter_only
@@ -1424,6 +1447,9 @@ def sub_workflow_detail(request, instance_id):
         or request.user.groups.filter(
             id__in=submission.form_definition.admin_groups.all()
         ).exists()
+        or request.user.groups.filter(
+            id__in=submission.form_definition.reviewer_groups.all()
+        ).exists()
     )
     if not can_view:
         messages.error(request, "You don't have permission to view this.")
@@ -1789,6 +1815,7 @@ def submission_pdf(request, submission_id):
         or request.user.is_superuser
         or user_can_approve(request.user, submission)
         or request.user.groups.filter(id__in=form_def.admin_groups.all()).exists()
+        or request.user.groups.filter(id__in=form_def.reviewer_groups.all()).exists()
     )
     if not can_view:
         return HttpResponseForbidden(
@@ -2555,6 +2582,9 @@ def bulk_export_submissions(request):
             or request.user.groups.filter(
                 id__in=sub.form_definition.admin_groups.all()
             ).exists()
+            or request.user.groups.filter(
+                id__in=sub.form_definition.reviewer_groups.all()
+            ).exists()
         )
         if can_view:
             allowed.append(sub)
@@ -2738,6 +2768,9 @@ def bulk_export_submissions_pdf(request):
             or request.user.groups.filter(
                 id__in=sub.form_definition.admin_groups.all()
             ).exists()
+            or request.user.groups.filter(
+                id__in=sub.form_definition.reviewer_groups.all()
+            ).exists()
         )
         if can_view:
             allowed.append(sub)
@@ -3145,7 +3178,24 @@ def my_submissions_ajax(request):
     category_slug = params.get("category", "").strip()
     form_slug = params.get("form", "").strip()
 
-    qs = FormSubmission.objects.filter(submitter=request.user)
+    reviewer_form_ids = (
+        FormDefinition.objects.filter(reviewer_groups__in=request.user.groups.all())
+        .values_list("id", flat=True)
+        .distinct()
+    )
+    qs = FormSubmission.objects.filter(
+        models.Q(submitter=request.user)
+        | models.Q(
+            form_definition__in=reviewer_form_ids,
+            status__in=[
+                "submitted",
+                "pending_approval",
+                "approved",
+                "rejected",
+                "withdrawn",
+            ],
+        )
+    ).distinct()
     records_total = qs.count()
 
     if category_slug:

{django_forms_workflows-0.36.2 → django_forms_workflows-0.37.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "django-forms-workflows"
-version = "0.36.2"
+version = "0.37.0"
 description = "Enterprise-grade, database-driven form builder with approval workflows and external data integration"
 license = "LGPL-3.0-only"
 readme = "README.md"