.

djangorota/rota/views.py

@@ -3,6 +3,7 @@ from django.urls import reverse
 
 from .models import RotaSchedule, Worker
 from .forms import WorkerForm, LeaveForm, RotaScheduleForm
+from .forms import WorkerSelfServiceForm
 from .services import run_rota_async
 from .forms import ShiftForm
 import json
@@ -568,6 +569,51 @@ def request_leave(request, token=None):
 	return render(request, "rota/leave_request.html", {"form": form, "worker": worker, "token": token})
 
 
+@require_http_methods(["GET", "POST"])
+def worker_settings_token(request, token):
+	"""Allow a worker identified by a request token to update simple settings
+	such as FTE and non-working days without requiring authentication.
+	"""
+	worker = None
+	if token:
+		try:
+			worker = get_object_or_404(Worker, request_token=token)
+		except Exception:
+			worker = None
+
+	if worker is None:
+		return HttpResponseBadRequest("Invalid token")
+
+	is_hx = request.headers.get("HX-Request", "false").lower() == "true"
+
+	if request.method == "POST":
+		form = WorkerSelfServiceForm(request.POST, instance=worker)
+		if form.is_valid():
+			form.save()
+			if is_hx:
+				# Return minimal fragment confirming success and trigger a leaveUpdated
+				# so any calendars can refresh (if they rely on worker settings).
+				resp = render_to_string("rota/partials/worker_settings_saved.html", {"worker": worker}, request=request)
+				response = HttpResponse(resp)
+				response["HX-Trigger"] = "closeModal,leaveUpdated"
+				return response
+			# Full page: redirect back to tokenized request page
+			return redirect(reverse('rota:request_leave_token', args=[token]))
+	else:
+		form = WorkerSelfServiceForm(instance=worker)
+
+	# HTMX modal request: return partial modal
+	if is_hx:
+		modal_html = render_to_string(
+			"rota/partials/worker_selfservice_modal.html",
+			{"form": form, "form_action": request.get_full_path(), "worker": worker},
+			request=request,
+		)
+		return HttpResponse(modal_html)
+
+	return render(request, "rota/worker_settings.html", {"form": form, "worker": worker, "token": token})
+
+
 def rota_options(request, rota_id):
 	"""HTMX-aware modal edit for rota.options JSON.