feat: custom body templates render reviewer comments + auto-detect finalizing task

Two new pieces of context for any NotificationRule body_template
string (also added to the file-template context, harmless extras):

- `task` — the finalizing/rejecting ApprovalTask. For workflow_approved
  and workflow_denied this is auto-detected from the submission's
  task history when no explicit task_id is passed: latest-approved
  task for workflow_approved, latest-rejected task for workflow_denied.
  So `{{ task.comments }}` and `{{ task.workflow_stage.name }}` work in
  custom bodies for those events without the engine threading the task
  through, and the admin "Retry failed" action gets the right task too.

- `public_comments` — denormalized list of
  {stage_name, status, actor, comment} dicts for every approved/rejected
  task with a non-empty comment, ordered by workflow flow
  (stage_number → step_number → completed_at). Lets a custom body do
  `{% for c in public_comments %}{{ c.stage_name }}: {{ c.comment }}
  {% endfor %}` without iterating the ApprovalTask model. Pending
  tasks and tasks without comments are excluded.

Also drops the over-aggressive _skip_stage_groups early-out in
_collect_notification_recipients. The per-stage filter shipped in
0.74.9 (assigned_group set, assigned_to NULL) is strictly more
correct: for the per-task approval_request use case it produces the
same outcome as the early-out (the eff_stage's task with assigned_to
set is excluded by the filter, so no group recipients), and for
workflow-level events it correctly considers OTHER stages on the
workflow that the early-out would have suppressed once auto-detection
picks a finalizing task that happens to be dynamic-assigned.

4 new tests cover:
  - public_comments loop renders in workflow order
  - {{ task.comments }} / {{ task.workflow_stage.name }} resolve via
    auto-detect for workflow_denied
  - Symmetric auto-detect for workflow_approved
  - public_comments excludes pending tasks and empty-comment tasks

(Reassign view fix shipped in the prior commit.)

Author: matteius

CHANGELOG.md

@@ -7,6 +7,50 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.74.10] - 2026-04-30
+
+### Added
+- **Custom NotificationRule body templates can now render reviewer
+  comments.** Two new pieces of context are available to any body
+  string (in addition to the existing `submission`, `form_data`,
+  `submission_url`, `approval_url`, `hide_approval_history`):
+  - `task` — the finalizing/rejecting task. For `workflow_approved`
+    and `workflow_denied` it's auto-detected when the caller didn't
+    pass a `task_id`, so `{{ task.comments }}` and
+    `{{ task.workflow_stage.name }}` work in custom bodies for those
+    events. The admin "Retry failed" action benefits from the same
+    auto-detection.
+  - `public_comments` — denormalized list of dicts with
+    `{stage_name, status, actor, comment}` for every approved/rejected
+    task with a non-empty comment, ordered by workflow flow
+    (stage → step → completed_at). Lets a custom body do
+    `{% for c in public_comments %}{{ c.stage_name }}:
+    {{ c.comment }}{% endfor %}` without iterating the model.
+    Pending tasks and tasks without comments are excluded.
+
+### Fixed
+- **`reassign_task` clears `assigned_group` when switching to an
+  individual.** The view set `task.assigned_to = new_assignee` and
+  saved only that field, leaving `task.assigned_group` populated from
+  the original group-fallback assignment. Two consequences:
+  the inbox AJAX serializer mis-attributed reassigned tasks to the
+  group (visible "Online Operations" instead of "Jane Doe" after
+  reassignment), and `notify_stage_groups` resolution (after the
+  0.74.9 fix) misclassified the stage as both dynamic and group at
+  once. Fix clears `assigned_group` and records the cleared value in
+  the AuditLog `changes`. Defensive change in the inbox serializer:
+  prefer `assigned_to` over `assigned_group` when both are set, so
+  any task already reassigned before the fix renders correctly.
+- **`notify_stage_groups` over-aggressive early-out removed.** A prior
+  guard skipped ALL group resolution when the triggering task had
+  `assigned_to` set. With the new auto-detection of the finalizing
+  task on `workflow_approved`/`workflow_denied` events, this could
+  silently swallow group notifications for OTHER stages on the
+  workflow. The per-stage filter shipped in 0.74.9
+  (`assigned_group_id IS NOT NULL AND assigned_to_id IS NULL`) is
+  strictly more correct and supersedes the early-out for both
+  per-task and workflow-level cases.
+
 ## [0.74.9] - 2026-04-30
 
 ### Fixed

django_forms_workflows/tasks.py

@@ -1176,20 +1176,17 @@ def _effective_stage_id():
     #     top of that double-notifies (and confuses the group, who never
     #     held the task).
     #
-    # The pre-existing `_skip_stage_groups` early-out (when the triggering
-    # task has assigned_to) is preserved for the approval_request / use_
-    # triggering_stage path — it's still the right behaviour there. For
-    # workflow-level events (workflow_approved/denied/form_withdrawn) no
-    # triggering task is passed, so that gate is false and the per-stage
-    # filter below does the work.
-    _skip_stage_groups = (
-        task is not None and getattr(task, "assigned_to_id", None) is not None
-    )
-    if (
-        getattr(notif, "notify_stage_groups", False)
-        and submission is not None
-        and not _skip_stage_groups
-    ):
+    # The per-stage filter below is strictly more correct than the prior
+    # `_skip_stage_groups` early-out and supersedes it. For the per-task
+    # approval_request use case: when use_triggering_stage=True, eff_stage
+    # is set to the triggering stage; if that stage's task has
+    # assigned_to set, the assigned_group_id__isnull=False filter excludes
+    # it → no group recipients (same outcome as the early-out). For
+    # workflow-level events the early-out was over-aggressive — once
+    # task auto-detection in send_notification_rules picks a finalizing
+    # task, that task's assigned_to status incorrectly suppressed group
+    # resolution for OTHER stages on the workflow.
+    if getattr(notif, "notify_stage_groups", False) and submission is not None:
         from django.contrib.auth import get_user_model
 
         from .models import StageApprovalGroup
@@ -1361,6 +1358,32 @@ def send_notification_rules(
     ).get(id=submission_id)
     form_data = submission.form_data or {}
     form_name = submission.form_definition.name
+
+    # Auto-detect the finalizing/rejecting task for workflow-level events
+    # so custom NotificationRule.body_template strings can address
+    # ``{{ task.comments }}`` / ``{{ task.workflow_stage.name }}`` without
+    # the caller having to know which task drove the decision. Also lets
+    # the admin "Retry failed" action re-fire these events without losing
+    # the task context. Only applies when no explicit ``task_id`` was
+    # passed; an explicit task always wins.
+    if not task_id:
+        if event == "workflow_approved":
+            _finalizing = (
+                submission.approval_tasks.filter(status="approved")
+                .order_by("-completed_at")
+                .first()
+            )
+            if _finalizing:
+                task_id = _finalizing.id
+        elif event == "workflow_denied":
+            _rejecting = (
+                submission.approval_tasks.filter(status="rejected")
+                .order_by("-completed_at")
+                .first()
+            )
+            if _rejecting:
+                task_id = _rejecting.id
+
     submission_url, approval_url = _build_form_field_notification_context(
         submission,
         ApprovalTask.objects.get(id=task_id) if task_id else None,
@@ -1377,6 +1400,34 @@ def send_notification_rules(
         except ApprovalTask.DoesNotExist:
             pass
 
+    # Build a denormalized "public_comments" list for the template context
+    # (file templates and per-rule body_template overrides alike). Each
+    # entry has stage_name / status / actor / comment so a custom body can
+    # do ``{% for c in public_comments %}{{ c.stage_name }}: {{ c.comment }}{% endfor %}``
+    # without knowing the model. Ordered by workflow flow (stage → step →
+    # completion time) so the audit reads top-to-bottom in the email.
+    _comments_qs = (
+        submission.approval_tasks.select_related("workflow_stage", "completed_by")
+        .filter(status__in=["approved", "rejected"])
+        .exclude(comments="")
+        .order_by("stage_number", "step_number", "completed_at")
+    )
+    public_comments: list[dict] = []
+    for _t in _comments_qs:
+        _actor = ""
+        if _t.completed_by:
+            _actor = _t.completed_by.get_full_name() or _t.completed_by.username
+        public_comments.append(
+            {
+                "stage_name": (
+                    _t.workflow_stage.name if _t.workflow_stage_id else _t.step_name
+                ),
+                "status": _t.status,
+                "actor": _actor,
+                "comment": _t.comments,
+            }
+        )
+
     rules_qs = (
         NotificationRule.objects.filter(event=event)
         .select_related("workflow", "stage")
@@ -1540,6 +1591,12 @@ def send_notification_rules(
             "submission_url": submission_url,
             "approval_url": approval_url,
             "hide_approval_history": hide_approval_history,
+            # Denormalized list of {stage_name, status, actor, comment}
+            # entries for every approved/rejected task with a non-empty
+            # public comment. Lets per-rule body_template overrides do
+            # ``{% for c in public_comments %}{{ c.stage_name }}:
+            # {{ c.comment }}{% endfor %}`` without iterating the model.
+            "public_comments": public_comments,
         }
         if task_id:
             try:

pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "django-forms-workflows"
-version = "0.74.9"
+version = "0.74.10"
 description = "Enterprise-grade, database-driven form builder with approval workflows and external data integration"
 license = "LGPL-3.0-only"
 readme = "README.md"