From d5d4882d071f64be4e4388a4b82e32fe2a1e5549 Mon Sep 17 00:00:00 2001
From: "Troll (Hermes Agent)" <ai@hallsworth.ca>
Date: Mon, 3 Aug 2026 19:07:22 +0000
Subject: [PATCH] feat: require customer approval before mark paid/deliver

- Disable checkboxes, payment ref input, and submit button in admin UI when customer has not approved.
- Add server-side guard in mark_paid_deliver action.
---
 app.py                       |  4 ++++
 templates/admin/request.html | 13 +++++++++----
 2 files changed, 13 insertions(+), 4 deletions(-)

diff --git a/app.py b/app.py
index a7d6444..da840be 100644
--- a/app.py
+++ b/app.py
@@ -859,6 +859,10 @@ def admin_request(rid):
 
         elif action == 'mark_paid_deliver':
             # Finalize: record Square payment ref, attach approved MP3s, email customer.
+            if req.get('customer_approved', 'none') == 'none':
+                flash('Customer must approve a version before you can mark paid or deliver.', 'error')
+                return redirect(url_for('admin_request', rid=rid))
+
             payment_ref = request.form.get('square_payment_ref', '').strip()
             if not payment_ref:
                 flash('Square payment reference is required.', 'error')
diff --git a/templates/admin/request.html b/templates/admin/request.html
index 05e87a0..9153641 100644
--- a/templates/admin/request.html
+++ b/templates/admin/request.html
@@ -300,8 +300,9 @@
             {% for fpath in files_to_show %}
               <div class="file-select">
                 <input type="checkbox" id="file_{{ loop.index }}" name="deliver_file" value="{{ fpath }}"
-                       {% if fpath in all_files %}checked{% endif %}>
-                <label for="file_{{ loop.index }}">{{ basename(fpath) }}</label>
+                       {% if fpath in all_files %}checked{% endif %}
+                       {% if req.customer_approved == 'none' %}disabled{% endif %}>
+                <label for="file_{{ loop.index }}"{% if req.customer_approved == 'none' %} style="opacity:.6"{% endif %}>{{ basename(fpath) }}</label>
                 {% if not (fpath == req.song_a_path or fpath == req.song_b_path) %}
                 <div class="old-rev">archived / revision file</div>
                 {% endif %}
@@ -311,10 +312,14 @@
             {% endfor %}
 
             <label for="square_payment_ref">Square Payment Reference</label>
-            <input type="text" id="square_payment_ref" name="square_payment_ref" placeholder="e.g. sq0idp-... or receipt number">
+            <input type="text" id="square_payment_ref" name="square_payment_ref" placeholder="e.g. sq0idp-... or receipt number"
+                   {% if req.customer_approved == 'none' %}disabled{% endif %}>
             <div class="actions">
-              <button type="submit" class="success">Mark Paid & Deliver</button>
+              <button type="submit" class="success" {% if req.customer_approved == 'none' %}disabled{% endif %}>Mark Paid & Deliver</button>
             </div>
+            {% if req.customer_approved == 'none' %}
+            <p style="margin-top:.5rem;color:#f87171;font-weight:600">⚠️ Customer must approve a version before you can mark paid or deliver.</p>
+            {% endif %}
           </form>
         </div>
       </div>