dbca-wa · dbca-serkank · Aug 13, 2026 · Jul 17, 2026 · Jul 17, 2026 · Jul 17, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -7,6 +7,41 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 Entries should be concise, single-sentence summaries without excessive technical detail. Focus on the user-facing impact rather than implementation details.
 
+## [1.1.0] - Unreleased (Requires DB Migration)
+
+### Added
+
+- Added discard and revert functionality allowing applicants to abandon draft applications by moving them to DISCARDED status, with the ability to restore them back to DRAFT for continued editing.
+- Added tab-based filtering system for My Applications page enabling applicants to organise applications by status category (Active, Terminated, Finalised), improving visibility of application lifecycle stages.
+- Added permanent links to questionnaire types on the new application page, enabling users to share and bookmark direct links to specific application types.
+- Added a full privacy statement page with section-by-section expandable content and dedicated contact details. Also updated the "Collection Notice Disclaimer" that we request applicants to acknowledge and agree prior to creating new applications.
+- Added a new favicon, replacing the default placeholder.
+- Added comprehensive feature development guide ([FEATURE-DEVELOPMENT.md](docs/FEATURE-DEVELOPMENT.md)) consolidating all mandatory best practices, testing requirements, code quality standards, and common commands in a single reference document for AI agents and developers.
+- Added new frontend as well as E2E tests for comprehensive coverage of "New application" page functionality.
+- Added formal specification of application status workflow ([STATUS-WORKFLOW.md](docs/STATUS-WORKFLOW.md)) documenting all 13 state transitions, permissions, and business rules with comprehensive test coverage across backend API (19 tests), E2E (6 tests), and frontend (10 statuses verified).
+- Added submission modal displayed after successful application submission and on page load for read-only applications, providing confirmation and options to download application PDF or exit the application.
+- Added technical officers review page workflow actions enabling reviewers to claim applications for review, reset applications to draft for applicant revision, and proceed applications to assessment stage with confirmation dialogs for each action.
+- Added audit logging for reviewer and assessor actions, recording every application status change with user, timestamp, and status transition details in an immutable audit log accessible through the Django admin interface for regulatory compliance and investigation purposes.
+- Added file size tracking and display for application attachments, automatically capturing file sizes during upload and displaying human-readable sizes (B, KB, MB) in the frontend attachment list and admin interface.
+
+### Changed
+
+- Strengthened review queue access control: non-reviewers now receive 404 responses across frontend menu, route loader, and backend routes when attempting to access the review page.
+- Renamed "Assessment" terminology to "Review" throughout the application, including API endpoints (/api/assessment → /api/review), menu navigation ("Assessment Queue" → "Review Queue"), and related components and fixtures, to align with domain conventions.
+- Standardised on npm for all frontend package management across development, CI, testing, and production environments to ensure identical dependency versions and predictable builds.
+- Disabled questionnaire tabs when only a single questionnaire to prevent user confusion from clicking non-functional tabs.
+- Improved handling of missing files and file size display in PDF generation, showing placeholder images for missing attachments and displaying human-readable file sizes alongside filenames for all file types.
+- **Dependency upgrades:** Updated 19 backend packages (Django 5.2.17, cryptography 50.0.0, djangorestframework 3.18.0, pytest-django 4.14.0) and 19 frontend packages (axios, eslint, globals, msw, typescript-eslint, and build tooling) with zero codebase modifications. Created [DEPENDENCY-UPGRADE.md](docs/DEPENDENCY-UPGRADE.md) documenting upgrade workflow and breaking-change analysis methodology.
+
+### Fixed
+
+- Fixed submit button allowing duplicate API submissions by adding loading indicator and disabled state during submission process.
+- Fixed attachment file-type icons intermittently disappearing (especially Excel) across both draft form editing and reviewer attachment views, which previously caused blank file tiles due to a static asset processing issue in production mode.
+
+### Removed
+
+- Removed `ACTION_REQUIRED` status; applications now use concrete workflow states (DRAFT → SUBMITTED → UNDER_REVIEW → UNDER_ASSESSMENT → decision outcomes) with explicit transition rules and permission boundaries.
+
 ## 1.0.3 - 2026-07-16
 
 ### Fixed
@@ -16,7 +51,6 @@ Entries should be concise, single-sentence summaries without excessive technical
 ### Changed
 
 - Removed redundant CSRF cookie settings (CSRF_COOKIE_NAME, CSRF_COOKIE_SAMESITE, CSRF_COOKIE_SECURE) as the application uses session-based CSRF protection instead.
-- Changed SESSION_COOKIE_SAMESITE from "Lax" to "Strict" unconditionally for improved security against cross-site cookie inclusion.
 
 ## 1.0.2 - 2026-07-14
 

diff --git a/Dockerfile b/Dockerfile
@@ -12,15 +12,13 @@ FROM node:22-trixie-slim AS builder_frontend
 # Build frontend assets in an isolated stage.
 WORKDIR /tmp/frontend
 
-# Copy dependency manifest first so dependency install can be cached across code-only changes.
-COPY frontend/package.json ./
+# Copy dependency manifests for deterministic dependency installation.
+# package-lock.json is committed to version control.
+COPY frontend/package*.json ./
 
-# Install frontend dependencies.
-# `npm ci` is preferred when package-lock.json exists; this project currently tracks bun.lock,
-# so `npm install` is used for compatibility while keeping flags conservative:
-# - `--no-audit`: skip npm's advisory audit during image builds to avoid extra network work and log noise.
-# - `--no-fund`: suppress funding notices so CI/CD logs stay focused on actionable output.
-RUN npm install --no-audit --no-fund
+# Install frontend dependencies using npm ci for reproducibility.
+# Flags: --no-audit (skip advisory audit), --no-fund (suppress funding notices).
+RUN npm ci --no-audit --no-fund
 
 # Copy frontend source after dependency install to preserve cache efficiency.
 COPY frontend /tmp/frontend/
@@ -32,7 +30,7 @@ RUN mkdir -p /tmp/backend/applications /tmp/backend/templates
 COPY backend/applications/models.py /tmp/backend/applications/
 COPY backend/templates/application-pdf-template.html /tmp/backend/templates/
 
-# Build production frontend assets, including hash-free pdf-icons.css.
+# Build production frontend assets.
 RUN npm run build
 
 

diff --git a/README.md b/README.md
@@ -6,6 +6,8 @@ Streamline DBCA authorisation workflows - from Animal Ethics to Section 40/45 -
 
 **Documentation is located in [docs/](docs/README.md).**
 
+**⚠️ Before any feature development, read [docs/FEATURE-DEVELOPMENT.md](docs/FEATURE-DEVELOPMENT.md) — this is the authoritative checklist for all development and must be followed on every session.**
+
 For setup and development instructions, start with [docs/DEVELOPMENT.md](docs/DEVELOPMENT.md).
 
 For testing, see the testing section in [docs/DEVELOPMENT.md](docs/DEVELOPMENT.md) or the comprehensive guide at [docs/TESTING.md](docs/TESTING.md).
@@ -32,12 +34,16 @@ This system supports DBCA authorisation workflows, including Animal Ethics and S
 
 **Frontend Development:** See [docs/FRONTEND-CONVENTIONS.md](docs/FRONTEND-CONVENTIONS.md) for React, TypeScript, and component guidelines.
 
-**Application Flows:** See [docs/APPLICATION-FLOWS.md](docs/APPLICATION-FLOWS.md) for user journeys, routes, and workflows.
+**Application Flows:** See [docs/FRONTEND-API-FLOWS.md](docs/FRONTEND-API-FLOWS.md) for user journeys, routes, and workflows.
+
+**Status Workflow:** See [docs/STATUS-WORKFLOW.md](docs/STATUS-WORKFLOW.md) for application status definitions and business logic.
 
 **File Management:** See [docs/FILE-MANAGEMENT.md](docs/FILE-MANAGEMENT.md) for attachment design and implementation.
 
 **Deployment:** See [docs/DEPLOYMENT.md](docs/DEPLOYMENT.md) for Kubernetes and kustomize configuration.
 
+**Dependencies:** See [docs/DEPENDENCY-UPGRADE.md](docs/DEPENDENCY-UPGRADE.md) for dependency upgrade process and guidelines.
+
 ## Writing style
 
 - Use British English spelling in code comments, docs, command names, and developer guidance.

diff --git a/THIRD_PARTY_NOTICES.md b/THIRD_PARTY_NOTICES.md
@@ -20,7 +20,7 @@ attribution obligations, those obligations continue to apply.
 
 | Package | Version reviewed | Licence |
 | --- | --- | --- |
-| Django | 5.2.14 | BSD-3-Clause |
+| Django | 5.2.17 | BSD-3-Clause |
 | psycopg | 3.3.4 | LGPL-3.0-only |
 | django-vite | 3.1.0 | Apache-2.0 |
 | whitenoise | 6.12.0 | MIT |
@@ -31,12 +31,12 @@ attribution obligations, those obligations continue to apply.
 | django-jsonform | 2.23.2 | BSD-3-Clause |
 | django-admin-tools | 0.9.3 | MIT |
 | frozendict | 2.4.7 | LGPL-3.0-only |
-| dbca-utils | 3.0.3 | Apache-2.0 |
-| djangorestframework | 3.17.1 | BSD-3-Clause |
+| dbca-utils | 3.0.13 | Apache-2.0 |
+| djangorestframework | 3.18.0 | BSD-3-Clause |
 | pyfsig | 1.1.1 | MIT |
 | django-storages | 1.14.6 | BSD-3-Clause |
 | django-admin-sortable2 | 2.3.1 | MIT |
-| requests | 2.33.1 | Apache-2.0 |
+| requests | 2.34.2 | Apache-2.0
 
 ### Backend compliance notes
 
@@ -53,17 +53,23 @@ attribution obligations, those obligations continue to apply.
 | @mui/material | 9.1.2 | MIT |
 | @mui/x-data-grid | 9.7.0 | MIT |
 | @mui/x-date-pickers | 9.7.0 | MIT |
-| @tailwindcss/vite | 4.3.2 | MIT |
-| axios | 1.18.1 | MIT |
+| @tailwindcss/vite | 4.3.3 | MIT |
+| axios | 1.19.0 | MIT |
 | dayjs | 1.11.21 | MIT |
-| react | 19.2.7 | MIT |
-| react-dom | 19.2.7 | MIT |
+| eslint | 10.8.1 | MIT |
+| globals | 17.11.0 | MIT |
+| msw | 2.15.0 | MIT |
+| react | 19.2.8 | MIT |
+| react-dom | 19.2.8 | MIT |
 | react-dropzone | 15.0.0 | MIT |
 | react-hook-form | 7.80.0 | MIT |
-| react-router | 7.18.1 | MIT |
-| tailwindcss | 4.3.2 | MIT |
+| react-router | 7.18.2 | MIT |
+| tailwindcss | 4.3.3 | MIT |
+| typescript | 6.0.3 | Apache-2.0 |
+| typescript-eslint | 8.67.0 | BSD-2-Clause |
 | underscore | 1.13.8 | MIT |
 | uuid | 14.0.1 | MIT |
+| vitest | 4.1.10 | MIT |
 
 ### Frontend transitive licence notes
 

diff --git a/VERSION b/VERSION
@@ -1 +1 @@
-1.0.3
+1.1.0
diff --git a/azure-pipelines.yml b/azure-pipelines.yml
@@ -155,7 +155,7 @@ stages:
       displayName: Install Playwright Chromium browser
     - script: |
         cd backend
-        poetry run pytest e2e/tests -v --tb=short --junitxml=e2e-junit.xml --browser chromium --tracing=retain-on-failure --screenshot=only-on-failure --video=retain-on-failure \
+        poetry run pytest e2e/tests -v --tb=short -n auto --dist loadscope --junitxml=e2e-junit.xml --browser chromium --tracing=retain-on-failure --screenshot=only-on-failure --video=retain-on-failure \
           2>&1 | tee "$(Build.ArtifactStagingDirectory)/e2e-debug/logs/pytest-e2e.log"
         status=${PIPESTATUS[0]}
         if [ "$status" -ne 0 ]; then
@@ -167,6 +167,7 @@ stages:
         DJANGO_SECRET_KEY: $(DJANGO_SECRET_KEY)
         DJANGO_VITE_TEST_DEV_MODE: 'false'
         DJANGO_VITE_TEST_MANIFEST_PATH: 'static/manifest.json'
+        TURNSTILE_SITE_KEY: '0x0000000000000000_e2e_test_key'
     - script: |
         python scripts/collect_e2e_failure_artifacts.py \
           --backend-root "$(Build.SourcesDirectory)/backend" \

diff --git a/backend/api/tests/conftest.py b/backend/api/tests/conftest.py
@@ -1,126 +1,35 @@
 """Shared fixtures for API endpoint test modules.
 
-This package-local conftest keeps API-focused factories close to endpoint
-behaviour tests while reusing core fixtures from backend/conftest.py.
+This module defines API-specific fixtures. Common factories (questionnaire_factory,
+application_factory, process_factory) are inherited from backend/conftest.py.
 """
 
 from itertools import count
 
 import pytest
+from applications.models import ApplicationAttachment
 from django.contrib.auth.models import Group
-
-from applications.models import Application, ApplicationAttachment, ApplicationStatus
-from processes.models import AuthorisationProcess
-from questionnaires.models import Questionnaire
+from django.core.files.uploadedfile import SimpleUploadedFile
+from users.models import User
 
 
 @pytest.fixture
-def assessor_group(db):
-    """Create the canonical assessor group used in review authorisation tests."""
-    return Group.objects.create(name="assessors")
+def reviewer_group(db):
+    """Create the canonical reviewer group used in review authorisation tests."""
+    return Group.objects.create(name="reviewers")
 
 
 @pytest.fixture
-def assessor_user(db, assessor_group):
-    """Create an authenticated assessor user linked to the assessor group."""
-    from users.models import User
-
-    user = User.objects.create_user(username="assessor", password="testpass123")
-    user.groups.add(assessor_group)
+def reviewer_user(db, reviewer_group):
+    """Create an authenticated reviewer user linked to the reviewer group."""
+    user = User.objects.create_user(username="reviewer", password="testpass123")
+    user.groups.add(reviewer_group)
     return user
 
 
-@pytest.fixture
-def process_factory(db):
-    """Return a factory that creates authorisation processes with deterministic defaults."""
-    sequence = count(1)
-
-    def _create(**overrides):
-        index = next(sequence)
-        values = {
-            "slug": f"proc-{index}",
-            "name": f"Process {index}",
-            "description": f"Process description {index}",
-            "sort_order": index,
-        }
-        values.update(overrides)
-        return AuthorisationProcess.objects.create(**values)
-
-    return _create
-
-
-@pytest.fixture
-def questionnaire_factory(db, process_factory, user):
-    """Return a factory that creates questionnaires for list/retrieve and versioning tests."""
-    sequence = count(1)
-
-    def _create(**overrides):
-        index = next(sequence)
-        process = overrides.pop("process", process_factory())
-        values = {
-            "process": process,
-            "code": f"form-{index}",
-            "name": f"Questionnaire {index}",
-            "description": f"Questionnaire description {index}",
-            "version": 1,
-            "document": {
-                "schema_version": "2025.07-1",
-                "steps": [
-                    {
-                        "title": "Step 1",
-                        "description": "",
-                        "sections": [
-                            {
-                                "title": "Section 1",
-                                "description": "",
-                                "questions": [
-                                    {
-                                        "label": "Question 1",
-                                        "type": "text",
-                                        "is_required": False,
-                                        "description": "",
-                                    }
-                                ],
-                            }
-                        ],
-                    }
-                ],
-            },
-            "sort_order": index,
-            "created_by": user,
-        }
-        values.update(overrides)
-        return Questionnaire.objects.create(**values)
-
-    return _create
-
-
-@pytest.fixture
-def application_factory(db, user, questionnaire_factory):
-    """Return a factory that creates application rows with configurable ownership and status."""
-
-    def _create(**overrides):
-        values = {
-            "owner": user,
-            "questionnaire": questionnaire_factory(),
-            "status": ApplicationStatus.DRAFT,
-            "document": {
-                "schema_version": "2025.07-1",
-                "active_step": 0,
-                "steps": [{"is_valid": None, "answers": {}}],
-            },
-        }
-        values.update(overrides)
-        return Application.objects.create(**values)
-
-    return _create
-
-
 @pytest.fixture
 def attachment_factory(db, application_factory):
     """Return a factory that creates attachment records bound to application/question pairs."""
-    from django.core.files.uploadedfile import SimpleUploadedFile
-
     sequence = count(1)
 
     def _create(**overrides):

diff --git a/.../tests/test_security_nondisclosure_api.py → ...d/api/tests/test_api_endpoint_security.py b/.../tests/test_security_nondisclosure_api.py → ...d/api/tests/test_api_endpoint_security.py
@@ -5,7 +5,7 @@
 import pytest
 from rest_framework import status
 
-from applications.models import ApplicationStatus
+from applications.statuses import ApplicationStatus
 
 
 pytestmark = [pytest.mark.api, pytest.mark.security]
@@ -143,3 +143,53 @@ def test_attachment_list_filter_does_not_disclose_foreign_or_unknown_application
     assert unknown_response.status_code == status.HTTP_200_OK
     assert foreign_response.data == []
     assert unknown_response.data == []
+
+
+@pytest.mark.django_db
+def test_reviewer_list_returns_404_for_non_reviewer(
+    api_client,
+    user,
+    reviewer_group,
+    process_factory,
+    questionnaire_factory,
+    application_factory,
+):
+    """Hide review endpoint from users without reviewer-group permissions by returning 404."""
+    process = process_factory(slug="review-hidden", sort_order=1)
+    process.reviewer_groups.add(reviewer_group)
+    application_factory(
+        questionnaire=questionnaire_factory(process=process),
+        status=ApplicationStatus.SUBMITTED,
+    )
+
+    api_client.force_authenticate(user=user)
+    response = api_client.get("/api/review")
+
+    assert response.status_code == status.HTTP_404_NOT_FOUND
+
+
+@pytest.mark.django_db
+def test_reviewer_patch_returns_404_for_non_reviewer(
+    api_client,
+    user,
+    reviewer_group,
+    process_factory,
+    questionnaire_factory,
+    application_factory,
+):
+    """Prevent non-reviewers from updating reviewer queue by returning 404 on PATCH."""
+    process = process_factory(slug="review-patch-hidden", sort_order=1)
+    process.reviewer_groups.add(reviewer_group)
+    application = application_factory(
+        questionnaire=questionnaire_factory(process=process),
+        status=ApplicationStatus.SUBMITTED,
+    )
+
+    api_client.force_authenticate(user=user)
+    response = api_client.patch(
+        f"/api/review/{application.key}",
+        {"status": ApplicationStatus.UNDER_REVIEW},
+        format="json",
+    )
+
+    assert response.status_code == status.HTTP_404_NOT_FOUND