Merge pull request #3755 from bcgov/release

Hotfix: 2026 Reporting Fix

Author: AlexZorkin

backend/lcfs/db/seeders/staging/test_compliance_report_seeder.py

@@ -127,30 +127,30 @@ async def seed_test_compliance_reports(session):
             "reporting_frequency": "ANNUAL",
             "nickname": "Original Report",
         },
-        # LCFS5 (org 5, user 11): Submitted 2025, reserved tx 106
+        # LCFS5 (org 5, user 11): Submitted 2025, reserved tx 105
         {
             "compliance_report_id": 105,
             "organization_id": 5,
             "compliance_period_id": 16,  # 2025
             "current_status_id": 2,  # Submitted
-            "transaction_id": 106,
-            # Supplemental off existing org 5 baseline (id 6) chain
-            "compliance_report_group_uuid": "1122a80e-99a3-447b-a62e-4c758dd83700",
-            "version": 1,
+            "transaction_id": 105,
+            # New 2025 report chain for org 5 (separate from 2024 report id 6)
+            "compliance_report_group_uuid": "11111111-1111-1111-1111-111111111105",
+            "version": 0,
             "reporting_frequency": "ANNUAL",
-            "nickname": "Supplemental Report 1",
+            "nickname": "Original Report",
         },
-        # LCFS6 (org 6, user 12): Submitted 2025, adjustment tx 105
+        # LCFS6 (org 6, user 12): Submitted 2025, adjustment tx 106
         {
             "compliance_report_id": 106,
             "organization_id": 6,
             "compliance_period_id": 16,
             "current_status_id": 2,  # Submitted
-            "transaction_id": 105,
+            "transaction_id": 106,
             "compliance_report_group_uuid": "11111111-1111-1111-1111-111111111106",
-            "version": 1,
+            "version": 0,
             "reporting_frequency": "ANNUAL",
-            "nickname": "Supplemental Report 1",
+            "nickname": "Original Report",
         },
         # LCFS7 (org 7, user 13): Submitted 2025, reserved tx 107
         {
@@ -160,9 +160,9 @@ async def seed_test_compliance_reports(session):
             "current_status_id": 2,  # Submitted
             "transaction_id": 107,
             "compliance_report_group_uuid": "11111111-1111-1111-1111-111111111107",
-            "version": 1,
+            "version": 0,
             "reporting_frequency": "ANNUAL",
-            "nickname": "Supplemental Report 1",
+            "nickname": "Original Report",
         },
         # LCFS8 (org 8, user 14): Submitted quarterly 2025
         {
@@ -196,7 +196,7 @@ async def seed_test_compliance_reports(session):
             "compliance_report_group_uuid": "11111111-1111-1111-1111-111111111110",
             "version": 0,
             "reporting_frequency": "ANNUAL",
-            "nickname": "Supplemental Report 1",
+            "nickname": "Original Report",
         },
         # New chain: Org 2, versions 0-2 in 2025 (all submitted for summary testing)
         {

backend/lcfs/db/seeders/staging/test_compliance_report_summary_seeder.py

@@ -392,7 +392,7 @@ async def seed_test_compliance_report_summaries(session):
         # 105 Analyst Adjustment 2025 (locked)
         # CR 105 locked analyst adj: fuel 10 + notional 8, retention 1, deferral 0.5 => line10/20 = 17.5
         {"summary_id": 105, "compliance_report_id": 105, "is_locked": True, "line_1_fossil_derived_base_fuel_gasoline": 40.0, "line_2_eligible_renewable_fuel_supplied_gasoline": 10.0, "line_3_total_tracked_fuel_supplied_gasoline": 50.0, "line_4_eligible_renewable_fuel_required_gasoline": 2.0, "line_5_net_notionally_transferred_gasoline": 8.0, "line_6_renewable_fuel_retained_gasoline": 1.0, "line_7_previously_retained_gasoline": 0.0, "line_8_obligation_deferred_gasoline": 0.5, "line_9_obligation_added_gasoline": 0.0, "line_10_net_renewable_fuel_supplied_gasoline": 17.5, "line_20_surplus_deficit_units": 17.5},
-        # 106 Supplier Supplemental 2025 (draft) - uses previous retention (line 7)
+        # 106 Original 2025 report (draft) - org 6's first 2025 report
         {
             "summary_id": 106,
             "compliance_report_id": 106,
@@ -403,13 +403,13 @@ async def seed_test_compliance_report_summaries(session):
             "line_4_eligible_renewable_fuel_required_gasoline": 2250000.0,
             "line_5_net_notionally_transferred_gasoline": -900000.0,
             "line_6_renewable_fuel_retained_gasoline": 0.0,
-            "line_7_previously_retained_gasoline": 750000.0,
+            "line_7_previously_retained_gasoline": 0.0,
             "line_8_obligation_deferred_gasoline": 0.0,
             "line_9_obligation_added_gasoline": 0.0,
-            "line_10_net_renewable_fuel_supplied_gasoline": 8850000.0,
-            "line_20_surplus_deficit_units": 8850000.0,
+            "line_10_net_renewable_fuel_supplied_gasoline": 8100000.0,
+            "line_20_surplus_deficit_units": 8100000.0,
         },
-        # 107 Gov Supplemental 2025 (draft) - uses previous retention (line 7) and retains more (line 6)
+        # 107 Original 2025 report (draft) - org 7's first 2025 report with retention
         {
             "summary_id": 107,
             "compliance_report_id": 107,
@@ -432,19 +432,19 @@ async def seed_test_compliance_report_summaries(session):
             "line_6_renewable_fuel_retained_gasoline": 100000.0,
             "line_6_renewable_fuel_retained_diesel": 50000.0,
             "line_6_renewable_fuel_retained_jet_fuel": 25000.0,
-            "line_7_previously_retained_gasoline": 200000.0,
-            "line_7_previously_retained_diesel": 100000.0,
+            "line_7_previously_retained_gasoline": 0.0,
+            "line_7_previously_retained_diesel": 0.0,
             "line_7_previously_retained_jet_fuel": 0.0,
             "line_8_obligation_deferred_gasoline": 0.0,
             "line_8_obligation_deferred_diesel": 0.0,
             "line_8_obligation_deferred_jet_fuel": 0.0,
             "line_9_obligation_added_gasoline": 0.0,
             "line_9_obligation_added_diesel": 0.0,
             "line_9_obligation_added_jet_fuel": 0.0,
-            "line_10_net_renewable_fuel_supplied_gasoline": 4450000.0,
-            "line_10_net_renewable_fuel_supplied_diesel": 3050000.0,
+            "line_10_net_renewable_fuel_supplied_gasoline": 4250000.0,
+            "line_10_net_renewable_fuel_supplied_diesel": 2950000.0,
             "line_10_net_renewable_fuel_supplied_jet_fuel": 1975000.0,
-            "line_20_surplus_deficit_units": 9475000.0,
+            "line_20_surplus_deficit_units": 9175000.0,
         },
         # 108 Early issuance quarterly draft 2025 - defers obligation (line 8)
         {

backend/lcfs/settings.py

@@ -97,6 +97,18 @@ class Settings(BaseSettings):
     # Feature flags
     feature_credit_market_notifications: bool = True
     feature_fuel_code_expiry_email: bool = True
+    # TEMPORARY SOLUTION - Issue #3730
+    # This is a temporary approach to gate compliance year access.
+    # A more robust long-term solution should be implemented to support future years
+    # dynamically (e.g., database-driven configuration per compliance period).
+    #
+    # Current behavior:
+    # - 2025: Enabled by default (backend allows it), frontend flag controls UI visibility
+    # - 2026: ALWAYS blocked unless org has early issuance enabled for 2026
+    #
+    # Set LCFS_FEATURE_REPORTING_2025_ENABLED=false to disable 2025 reporting on backend.
+    # Frontend has corresponding flag: reporting2025Enabled in config.ts
+    feature_reporting_2025_enabled: bool = True
 
     def __init__(self, **kwargs):
         # Map APP_ENVIRONMENT to environment if present

backend/lcfs/tests/organization/test_organization_validation.py

@@ -71,18 +71,18 @@ async def test_update_transfer_success(organization_validation, mock_transaction
 
 @pytest.mark.anyio
 async def test_create_compliance_report_success(
-    organization_validation, mock_report_repo, set_mock_user, fastapi_app
+    organization_validation, mock_report_repo
 ):
-    # Mock user setup
-    set_mock_user(fastapi_app, [RoleEnum.SUPPLIER])
-
     # Mock the request object and its attributes
     mock_request = MagicMock()
     mock_request.user.organization.organization_id = 1
     organization_validation.request = mock_request
 
-    # Mock the report repository methods
-    mock_report_repo.get_compliance_period.return_value = True
+    # Mock the compliance period with proper attributes
+    # The validation checks period.description for 2025/2026 restrictions
+    mock_period = MagicMock()
+    mock_period.description = "2024"
+    mock_report_repo.get_compliance_period.return_value = mock_period
     mock_report_repo.get_compliance_report_by_period.return_value = False
 
     # Call the method under test

backend/lcfs/web/api/compliance_report/validation.py

@@ -4,20 +4,36 @@
 from lcfs.db.models.user.Role import RoleEnum
 from lcfs.db.models.compliance.ComplianceReportStatus import ComplianceReportStatusEnum
 from lcfs.web.api.compliance_report.repo import ComplianceReportRepository
+from lcfs.web.api.organizations.repo import OrganizationsRepository
 from fastapi import status
 from lcfs.web.api.role.schema import user_has_roles
+from lcfs.settings import settings
 
 
 class ComplianceReportValidation:
     def __init__(
         self,
         request: Request = None,
         repo: ComplianceReportRepository = Depends(ComplianceReportRepository),
+        org_repo: OrganizationsRepository = Depends(OrganizationsRepository),
     ) -> None:
         self.request = request
         self.repo = repo
+        self.org_repo = org_repo
 
     async def validate_organization_access(self, compliance_report_id: int):
+        """
+        Validates that the user has access to the specified compliance report.
+
+        TEMPORARY SOLUTION - Issue #3730
+        This method includes temporary year-based access checks for 2025/2026.
+        A more robust long-term solution should be implemented to support future years
+        dynamically (e.g., database-driven configuration per compliance period).
+
+        Compliance year access rules (also enforced in organization/validation.py):
+        - 2025: Blocked when feature_reporting_2025_enabled is False
+        - 2026: ALWAYS requires early issuance, regardless of 2025 flag status
+        """
         compliance_report = await self.repo.get_compliance_report_schema_by_id(
             compliance_report_id
         )
@@ -34,15 +50,42 @@ async def validate_organization_access(self, compliance_report_id: int):
             else None
         )
 
-        if (
-            not user_has_roles(self.request.user, [RoleEnum.GOVERNMENT])
-            and organization_id != user_organization_id
-        ):
+        is_government = user_has_roles(self.request.user, [RoleEnum.GOVERNMENT])
+
+        if not is_government and organization_id != user_organization_id:
             raise HTTPException(
                 status_code=status.HTTP_403_FORBIDDEN,
                 detail="User does not have access to this compliance report.",
             )
 
+        # For non-government users, validate access to 2025/2026 compliance periods
+        # Government users can always access all reports for oversight
+        if not is_government and user_organization_id:
+            compliance_period = compliance_report.compliance_period
+            period_desc = (
+                compliance_period.description
+                if hasattr(compliance_period, "description")
+                else str(compliance_period)
+            )
+
+            # 2025: Blocked when feature_reporting_2025_enabled is False
+            if period_desc == "2025" and not settings.feature_reporting_2025_enabled:
+                raise HTTPException(
+                    status_code=status.HTTP_403_FORBIDDEN,
+                    detail="2025 reporting is not yet available.",
+                )
+
+            # 2026: ALWAYS requires early issuance, regardless of 2025 flag status
+            if period_desc == "2026":
+                early_issuance = await self.org_repo.get_early_issuance_by_year(
+                    user_organization_id, "2026"
+                )
+                if not early_issuance or not early_issuance.has_early_issuance:
+                    raise HTTPException(
+                        status_code=status.HTTP_403_FORBIDDEN,
+                        detail="2026 reporting is only available to early issuance suppliers.",
+                    )
+
         return compliance_report
 
     async def validate_compliance_report_access(

backend/lcfs/web/api/organization/validation.py

@@ -8,6 +8,7 @@
 from lcfs.web.api.compliance_report.schema import ComplianceReportCreateSchema
 from lcfs.web.api.compliance_report.repo import ComplianceReportRepository
 from lcfs.utils.constants import LCFS_Constants
+from lcfs.settings import settings
 
 
 class OrganizationValidation:
@@ -110,6 +111,38 @@ async def create_compliance_report(
         )
         if not period:
             raise HTTPException(status_code=404, detail="Compliance period not found")
+
+        # TEMPORARY SOLUTION - Issue #3730
+        # This is a temporary approach to gate compliance year access.
+        # A more robust long-term solution should be implemented to support future years
+        # dynamically (e.g., database-driven configuration per compliance period).
+        #
+        # Compliance year access rules (also enforced in compliance_report/validation.py):
+        # - 2025: Blocked when feature_reporting_2025_enabled is False
+        # - 2026: ALWAYS requires early issuance, regardless of 2025 flag status
+
+        # Validate access to 2025/2026 compliance periods
+        # 2025: Blocked when feature_reporting_2025_enabled is False
+        if (
+            period.description == "2025"
+            and not settings.feature_reporting_2025_enabled
+        ):
+            raise HTTPException(
+                status_code=status.HTTP_403_FORBIDDEN,
+                detail="2025 reporting is not yet available.",
+            )
+
+        # 2026: ALWAYS requires early issuance, regardless of 2025 flag status
+        if period.description == "2026":
+            early_issuance = await self.org_repo.get_early_issuance_by_year(
+                organization_id, "2026"
+            )
+            if not early_issuance or not early_issuance.has_early_issuance:
+                raise HTTPException(
+                    status_code=status.HTTP_403_FORBIDDEN,
+                    detail="2026 reporting is only available to early issuance suppliers.",
+                )
+
         is_report_present = await self.report_repo.get_compliance_report_by_period(
             organization_id, report_data.compliance_period
         )

backend/lcfs/web/api/organizations/services.py

@@ -568,6 +568,24 @@ async def get_organization(self, organization_id: int):
 
         return organization
 
+    @service_handler
+    async def get_early_issuance_for_year(
+        self, organization_id: int, compliance_year: str
+    ) -> bool:
+        """
+        Check if an organization has early issuance enabled for a specific compliance year.
+        Used to determine if an organization can create compliance reports for future years.
+
+        TEMPORARY SOLUTION - Issue #3730
+        This method is part of a temporary approach to gate 2026 compliance year access.
+        A more robust long-term solution should be implemented to support future years
+        dynamically (e.g., database-driven configuration per compliance period).
+        """
+        early_issuance = await self.repo.get_early_issuance_by_year(
+            organization_id, compliance_year
+        )
+        return early_issuance.has_early_issuance if early_issuance else False
+
     @service_handler
     async def get_penalty_analytics(
         self, organization_id: int

backend/lcfs/web/api/organizations/views.py

@@ -426,6 +426,39 @@ async def get_balances(request: Request, service: OrganizationsService = Depends
     )
 
 
+@router.get(
+    "/current/early-issuance/{compliance_year}",
+    response_model=Dict[str, bool],
+    status_code=status.HTTP_200_OK,
+)
+@view_handler([RoleEnum.SUPPLIER])
+async def get_current_org_early_issuance(
+    request: Request,
+    compliance_year: str,
+    service: OrganizationsService = Depends(),
+):
+    """
+    Check if the current user's organization has early issuance enabled for a specific compliance year.
+    Used to determine if an organization can create compliance reports for future years (e.g., 2026).
+
+    TEMPORARY SOLUTION - Issue #3730
+    This endpoint is part of a temporary approach to gate 2026 compliance year access.
+    A more robust long-term solution should be implemented to support future years
+    dynamically (e.g., database-driven configuration per compliance period).
+    """
+    org_id = request.user.organization_id
+    if not org_id:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="User is not associated with an organization",
+        )
+
+    has_early_issuance = await service.get_early_issuance_for_year(
+        org_id, compliance_year
+    )
+    return {"hasEarlyIssuance": has_early_issuance}
+
+
 @router.put(
     "/current/credit-market",
     response_model=OrganizationResponseSchema,

frontend/src/hooks/useOrganization.js

@@ -300,6 +300,45 @@ export const useGetOrgComplianceReportReportedYears = (orgID, options = {}) => {
   })
 }
 
+/**
+ * Hook to check if the current organization has early issuance enabled for a specific compliance year.
+ * Used to determine if an organization can create compliance reports for future years (e.g., 2026).
+ *
+ * TEMPORARY SOLUTION - Issue #3730
+ * This hook is part of a temporary approach to gate 2026 compliance year access.
+ * A more robust long-term solution should be implemented to support future years
+ * dynamically (e.g., backend-driven configuration per compliance period).
+ */
+export const useOrgEarlyIssuance = (complianceYear, options = {}) => {
+  const client = useApiService()
+
+  const {
+    staleTime = DEFAULT_STALE_TIME,
+    cacheTime = DEFAULT_CACHE_TIME,
+    enabled = true,
+    ...restOptions
+  } = options
+
+  return useQuery({
+    queryKey: ['org-early-issuance', complianceYear],
+    queryFn: async () => {
+      if (!complianceYear) {
+        throw new Error('Compliance year is required')
+      }
+      const response = await client.get(
+        `/organizations/current/early-issuance/${complianceYear}`
+      )
+      return response.data
+    },
+    enabled: enabled && !!complianceYear,
+    staleTime,
+    cacheTime,
+    retry: 3,
+    retryDelay: (attemptIndex) => Math.min(1000 * 2 ** attemptIndex, 30000),
+    ...restOptions
+  })
+}
+
 // Mutation hooks for updating organization data
 export const useUpdateOrganization = (orgID, options = {}) => {
   const client = useApiService()