fix(workshop): restrict workshop/mechanic views to only 'autorizada' status

pos/blueprints/service_order_bp.py

@@ -48,6 +48,9 @@ _MECHANIC_HIDDEN_STATUSES = {
     'por_facturar', 'facturada'
 }
 
+# Statuses visible to workshop/mechanic accounts (taller only works on authorized orders).
+_TALLER_ALLOWED_STATUSES = {'autorizada'}
+
 
 def _can_view_workshop():
     return g.employee_role in _WORKSHOP_VIEW_ROLES or 'workshop.view' in g.permissions
@@ -143,11 +146,10 @@ def list_orders():
         )
         if _is_restricted_workshop_viewer():
             result['data'] = [_redact_order_for_mechanic(o) for o in result.get('data', [])]
-        # Shared mechanic account can see all orders except commercial/closed statuses.
-        if g.employee_role == 'mechanic':
+            # Workshop/mechanic accounts only see orders ready to be worked on.
             result['data'] = [
                 o for o in result.get('data', [])
-                if o.get('status') not in _MECHANIC_HIDDEN_STATUSES
+                if o.get('status') in _TALLER_ALLOWED_STATUSES
             ]
         return jsonify(result)
     finally:
@@ -237,8 +239,8 @@ def get_order(so_id):
         order = get_service_order(conn, so_id)
         if not order:
             return jsonify({'error': 'Service order not found'}), 404
-        # Shared mechanic account cannot view commercial/closed statuses.
-        if g.employee_role == 'mechanic' and order.get('status') in _MECHANIC_HIDDEN_STATUSES:
+        # Workshop/mechanic accounts can only view orders that are ready to be worked on.
+        if _is_restricted_workshop_viewer() and order.get('status') not in _TALLER_ALLOWED_STATUSES:
             return jsonify({'error': 'No tienes acceso a esta orden'}), 403
         return jsonify(_redact_order_for_mechanic(order))
     finally: