New features
- Review actions on submitted forms. Any submission in Awaiting review now shows Approve, Request changes, and Reject buttons for reviewers. Each action stamps the submission with the reviewer, the review time, and (optionally) notes, so completed forms carry a clear audit trail of who signed off and when.
- “Changes requested” bounces a form back to the submitter. Instead of rejecting outright, a reviewer can send a submission back with required notes explaining what needs to be fixed. The form becomes editable again for the original submitter (just like a draft), and it flows back through the same submit → review cycle when they’re ready.
- Reviewer notes required on reject and request-changes. Rejecting a submission or requesting changes both require notes, so submitters always get a reason. Notes are optional on approvals.
- New submission statuses. Submissions now progress through Draft → Awaiting review → Approved / Rejected / Changes requested. Approved and rejected are terminal and read-only; changes-requested is editable and reusable.
Updates
- Approval permissions. The Approve, Reject, and Request changes actions are gated behind the existing
form_submissions:managerole permission, so only reviewers see them — day-to-day submitters (form_submissions:create/:view) are unaffected. Assign roles in Users and Roles. - Reviewers can’t self-approve their own submissions. Even if a reviewer submits their own form, the approve/reject/request-changes actions enforce the manage permission explicitly at the server, so the same person can’t push a form all the way through to Approved on their own.
- Forms status page refreshed. Forms and Exports Status now lists approvals as live and updates the “still planned” list accordingly.