From 644bfa225decdd52bd953386afcbfc4deb011b15 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bj=C3=B6rn=20Fromme?= <fromme@dreipunktnull.com>
Date: Thu, 13 Aug 2026 17:20:17 +0200
Subject: [PATCH] feat: view and edit comments of uploaded documents

addresses #869eg7tv1
---
 .../Document/CommentController.php            | 62 +++++++++++++++++++
 src/Security/Voter/UploadVoter.php            |  5 +-
 .../document/accepted.html.twig               | 10 +++
 .../administrative/document/index.html.twig   | 10 +++
 .../document/modal_comment.html.twig          | 24 +++++++
 5 files changed, 109 insertions(+), 2 deletions(-)
 create mode 100644 src/Controller/Administrative/Document/CommentController.php
 create mode 100644 templates/administrative/document/modal_comment.html.twig

diff --git a/src/Controller/Administrative/Document/CommentController.php b/src/Controller/Administrative/Document/CommentController.php
new file mode 100644
index 0000000..9f9b225
--- /dev/null
+++ b/src/Controller/Administrative/Document/CommentController.php
@@ -0,0 +1,62 @@
+<?php
+
+namespace App\Controller\Administrative\Document;
+
+use App\Controller\Traits\ReturnUrlTrait;
+use App\Entity\Upload;
+use App\Htmx\HxRedirectResponse;
+use Doctrine\ORM\EntityManagerInterface;
+use Psr\Log\LoggerInterface;
+use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
+use Symfony\Component\Form\Extension\Core\Type\TextareaType;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\Routing\Attribute\Route;
+use Symfony\Component\Security\Http\Attribute\IsGranted;
+
+class CommentController extends AbstractController
+{
+    use ReturnUrlTrait;
+
+    public function __construct(
+        private readonly EntityManagerInterface $entityManager,
+        private readonly LoggerInterface $logger,
+    ) {
+    }
+
+    #[Route('/administrative/document/comment/{uuid}', name: 'app_administrative_document_comment')]
+    #[IsGranted('ROLE_ADMINISTRATIVE')]
+    #[IsGranted('COMMENT', subject: 'document')]
+    public function index(Upload $document, Request $request): Response
+    {
+        $form = $this
+            ->createFormBuilder($document, ['hx_post' => $request->getUri()])
+            ->add('comment', TextareaType::class, [
+                'label' => 'Kommentar',
+                'required' => false,
+                'attr' => [
+                    'rows' => 5,
+                ],
+            ])
+            ->getForm()
+        ;
+        $form->handleRequest($request);
+
+        if ($form->isSubmitted() && $form->isValid()) {
+            $this->entityManager->flush();
+
+            $this->addFlash('success', 'Der Kommentar wurde aktualisiert');
+            $this->logger->info('Update document comment', [
+                'document_id' => $document->getId(),
+                'document_filename' => $document->getOriginalFilename(),
+            ]);
+
+            return new HxRedirectResponse($this->getReturnUrl($request, 'app_administrative_document_index'));
+        }
+
+        return $this->render('administrative/document/modal_comment.html.twig', [
+            'form' => $form->createView(),
+            'document' => $document,
+        ]);
+    }
+}
diff --git a/src/Security/Voter/UploadVoter.php b/src/Security/Voter/UploadVoter.php
index 5af0873..1291ff5 100644
--- a/src/Security/Voter/UploadVoter.php
+++ b/src/Security/Voter/UploadVoter.php
@@ -14,6 +14,7 @@ class UploadVoter extends Voter
     public const DELETE = 'DELETE';
     public const DOWNLOAD = 'DOWNLOAD';
     public const CHECK = 'CHECK';
+    public const COMMENT = 'COMMENT';
 
     public function __construct(private readonly Security $security)
     {
@@ -25,7 +26,7 @@ class UploadVoter extends Voter
             return false;
         }
 
-        return in_array($attribute, [static::VIEW, static::DELETE, static::DOWNLOAD, static::CHECK]);
+        return in_array($attribute, [static::VIEW, static::DELETE, static::DOWNLOAD, static::CHECK, static::COMMENT]);
     }
 
     protected function voteOnAttribute(string $attribute, mixed $subject, TokenInterface $token): bool
@@ -35,7 +36,7 @@ class UploadVoter extends Voter
 
         // Administrative users have full access
         if (true === $this->security->isGranted('ROLE_ADMINISTRATIVE')) {
-            if (true === in_array($attribute, [static::VIEW, static::DELETE, static::DOWNLOAD])) {
+            if (true === in_array($attribute, [static::VIEW, static::DELETE, static::DOWNLOAD, static::COMMENT])) {
                 return true;
             }
 
diff --git a/templates/administrative/document/accepted.html.twig b/templates/administrative/document/accepted.html.twig
index 76e142d..a00f5e3 100644
--- a/templates/administrative/document/accepted.html.twig
+++ b/templates/administrative/document/accepted.html.twig
@@ -90,6 +90,16 @@
                                             {{ icon('delete') }}
                                         </button>
                                     {% endif %}
+                                    {% if is_granted('COMMENT', upload) %}
+                                        <button type="button"
+                                                class="{{ html_classes({ 'text-gray-300': not upload.comment }) }}"
+                                                title="{{ upload.comment ? 'Kommentar bearbeiten' : 'Kommentar hinzufügen' }}"
+                                                hx-get="{{ path('app_administrative_document_comment', { 'uuid': upload.uuid, 'r': return_url() }) }}"
+                                                hx-target="body"
+                                                hx-swap="beforeend">
+                                            {{ icon('feedback') }}
+                                        </button>
+                                    {% endif %}
                                     <a href="{{ path('app_common_download', { 'uuid': upload.uuid, 'inline': false }) }}"
                                        target="_blank"
                                        title="Download und Markierung">
diff --git a/templates/administrative/document/index.html.twig b/templates/administrative/document/index.html.twig
index 50a0a5f..f2beb1a 100644
--- a/templates/administrative/document/index.html.twig
+++ b/templates/administrative/document/index.html.twig
@@ -99,6 +99,16 @@
                                             {{ icon('delete') }}
                                         </button>
                                     {% endif %}
+                                    {% if is_granted('COMMENT', upload) %}
+                                        <button type="button"
+                                                class="{{ html_classes({ 'text-gray-300': not upload.comment }) }}"
+                                                title="{{ upload.comment ? 'Kommentar bearbeiten' : 'Kommentar hinzufügen' }}"
+                                                hx-get="{{ path('app_administrative_document_comment', { 'uuid': upload.uuid, 'r': return_url() }) }}"
+                                                hx-target="body"
+                                                hx-swap="beforeend">
+                                            {{ icon('feedback') }}
+                                        </button>
+                                    {% endif %}
                                     {% if is_granted('CHECK', upload) %}
                                         <button type="button"
                                                 hx-get="{{ path('app_administrative_document_check', { 'uuid': upload.uuid, 'r': return_url() }) }}"
diff --git a/templates/administrative/document/modal_comment.html.twig b/templates/administrative/document/modal_comment.html.twig
new file mode 100644
index 0000000..e266899
--- /dev/null
+++ b/templates/administrative/document/modal_comment.html.twig
@@ -0,0 +1,24 @@
+{% extends 'htmx_modal.html.twig' %}
+
+{% block title %}Kommentar{% endblock %}
+
+{% block content %}
+    <a href="{{ path('app_common_download', { 'uuid': document.uuid, 'inline': true }) }}"
+       target="_blank"
+       class="flex justify-between items-center pb-4"
+       title="Dokument öffnen">
+        <h2 class="font-bold text-lg">
+            {{ ('label.document.type.' ~ document.type)|trans }} {{ document.disposition.teamer }} vom {{ document.createdAt|date('d.m.Y') }}
+        </h2>
+        {{ icon('eye') }}
+    </a>
+    {{ form_start(form) }}
+    <div class="pb-4">
+        {{ form_row(form.comment) }}
+    </div>
+    <button type="submit" class="btn">
+        Aktualisieren
+    </button>
+    {{ form_rest(form) }}
+    {{ form_end(form) }}
+{% endblock %}