Clarify invoice privileged role messaging (#300)

* Add Workflows Engineer to invoice privileged roles

* Fix denial message and test assertions to derive from _PRIVILEGED_ROLES

- Build the access-denied message dynamically from _PRIVILEGED_ROLES so
  role names are always in sync without manual updates
- Update the header comment to reference _PRIVILEGED_ROLES instead of
  hard-coding "Steering Committee"
- Import _PRIVILEGED_ROLES in tests and assert against it so future role
  additions are covered automatically
- Add Workflows Engineer fixture and access test

* Clarify invoice privileged role messaging

---------

Co-authored-by: Michael Wu <michaelmwu@gmail.com>

Author: lairwaves

apps/discord_bot/src/five08/discord_bot/cogs/invoices.py

@@ -27,10 +27,13 @@
 STATUS_LABEL = {0: "Draft", 1: "Submitted", 2: "Cancelled"}
 
 # Invoice access rules — a caller may validate an invoice if any of these hold:
-#   1. They have Steering Committee role or above (full access).
+#   1. They have Steering Committee-level access (full access).
 #   2. They created the invoice (invoice owner matches one of their ERP emails).
 #   3. They are on the invoice's ERP project roster.
-_PRIVILEGED_ROLES = ["Steering Committee"]
+#
+# Workflows Engineer is a Steering Committee-level role in role_decorators.
+_PRIVILEGED_ROLE_REQUIREMENTS = ["Steering Committee"]
+_PRIVILEGED_ROLE_LABELS = ["Steering Committee", "Workflows Engineer"]
 
 
 def _can_view_invoice(
@@ -72,7 +75,7 @@ def _resolve_access(
         with no ERP identity returns (False, [], []).
         """
         roles = getattr(interaction.user, "roles", [])
-        if check_user_roles_with_hierarchy(roles, _PRIVILEGED_ROLES):
+        if check_user_roles_with_hierarchy(roles, _PRIVILEGED_ROLE_REQUIREMENTS):
             return True, [], []
 
         emails = project_viewer_emails_for_discord(settings, str(interaction.user.id))
@@ -115,8 +118,9 @@ async def validate_invoice_command(
                 self._resolve_access, interaction
             )
             if not include_all and not emails:
+                roles_str = " or ".join(_PRIVILEGED_ROLE_LABELS)
                 await interaction.followup.send(
-                    "Invoice validation is available to Steering Committee members "
+                    f"Invoice validation is restricted to {roles_str} "
                     "or confirmed ERP project members.",
                     ephemeral=True,
                 )

tests/unit/test_invoices_cog.py

@@ -4,7 +4,7 @@
 
 import pytest
 
-from five08.discord_bot.cogs.invoices import InvoicesCog
+from five08.discord_bot.cogs.invoices import InvoicesCog, _PRIVILEGED_ROLE_LABELS
 from five08.clients.erpnext import ERPNextAPIError
 
 
@@ -45,6 +45,12 @@ def mock_interaction() -> AsyncMock:
     return _make_interaction(role_names=["Steering Committee"], user_id=1001)
 
 
+@pytest.fixture
+def mock_workflows_engineer_interaction() -> AsyncMock:
+    """A privileged (Workflows Engineer) caller with full invoice access."""
+    return _make_interaction(role_names=["Workflows Engineer"], user_id=1002)
+
+
 @pytest.fixture
 def mock_member_interaction() -> AsyncMock:
     """A non-privileged caller subject to owner/project access rules."""
@@ -148,10 +154,27 @@ async def test_validate_invoice_denied_without_erp_identity(
             cog, mock_member_interaction, mock_doctype, "TEST-SINV-0001"
         )
     sent = mock_member_interaction.followup.send.call_args.args[0]
-    assert "Steering Committee" in sent
+    assert all(role in sent for role in _PRIVILEGED_ROLE_LABELS)
     cog.client.get_invoice.assert_not_called()
 
 
+@pytest.mark.asyncio
+async def test_validate_invoice_allowed_for_workflows_engineer(
+    cog, mock_workflows_engineer_interaction, mock_doctype
+):
+    """Workflows Engineer gets include_all access without needing an ERP identity."""
+    cog.client.get_invoice = Mock(return_value=VALID_INVOICE)
+    with patch(
+        "five08.discord_bot.cogs.invoices.project_viewer_emails_for_discord"
+    ) as mock_project_viewer_emails:
+        await cog.validate_invoice_command.callback(
+            cog, mock_workflows_engineer_interaction, mock_doctype, "TEST-SINV-0001"
+        )
+    embed = mock_workflows_engineer_interaction.followup.send.call_args.kwargs["embed"]
+    assert "No issues found" in embed.title
+    mock_project_viewer_emails.assert_not_called()
+
+
 @pytest.mark.asyncio
 async def test_validate_invoice_allowed_for_invoice_owner(
     cog, mock_member_interaction, mock_doctype