feat(backend): add review_status field and enforce Pending workflow

backend/movements/migrations/0005_itemmovementrequest_review_status.py

@@ -0,0 +1,20 @@
+# Generated by Django 5.2.8 on 2026-03-08 02:57
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("movements", "0004_delete_itemhistory"),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="itemmovementrequest",
+            name="review_status",
+            field=models.CharField(
+                choices=[("PENDING", "Pending"), ("APPROVED", "Approved")], default="PENDING", max_length=10
+            ),
+        ),
+    ]

backend/movements/models.py

@@ -16,6 +16,11 @@ class ItemMovementRequest(models.Model):
         ("CANCELLED", "Cancelled"),
     ]
 
+    REVIEW_STATUS_CHOICES = [
+        ("PENDING", "Pending"),
+        ("APPROVED", "Approved"),
+    ]
+
     item = models.ForeignKey(CollectionItem, on_delete=models.CASCADE, related_name="movement_requests")
     requested_by = models.ForeignKey(
         settings.AUTH_USER_MODEL,
@@ -27,6 +32,11 @@ class ItemMovementRequest(models.Model):
     to_location = models.ForeignKey(Location, on_delete=models.PROTECT, related_name="movement_requests_to")
 
     status = models.CharField(max_length=20, choices=STATUS_CHOICES, default="WAITING_APPROVAL")
+    review_status = models.CharField(
+        max_length=10,
+        choices=REVIEW_STATUS_CHOICES,
+        default="PENDING",
+    )
 
     admin = models.ForeignKey(
         settings.AUTH_USER_MODEL,

backend/movements/serializers.py

@@ -41,6 +41,7 @@ class Meta:
             "from_location",
             "to_location",
             "status",
+            "review_status",
             "admin",
             "admin_username",
             "admin_comment",
@@ -51,12 +52,17 @@ class Meta:
             "id",
             "requested_by",
             "status",
+            "review_status",
             "admin",
             "admin_comment",
             "created_at",
             "updated_at",
         ]
 
     def create(self, validated_data):
-        # Volunteer is the logged-in user.
+        validated_data["review_status"] = "PENDING"
         return super().create(validated_data)
+
+    def update(self, instance, validated_data):
+        validated_data["review_status"] = "PENDING"
+        return super().update(instance, validated_data)