04/28 Updated sprint 4 & 5

routes/users.py

@@ -6,7 +6,7 @@ User management routes (admin-only operations).
 Routes: /users/*, /api/users/stats, /api/locations-by-projects,
         /api/roles/permissions, /api/geocode, /api/reverse-geocode
 """
-from flask import Blueprint, render_template, request, redirect, flash, session, jsonify, url_for
+from flask import abort, Blueprint, render_template, request, redirect, flash, session, jsonify, url_for
 from datetime import datetime, timedelta
 import json
 
@@ -349,7 +349,9 @@ def demote_user(user_id):
 def edit_user(user_id):
     """Edit existing user with Project Manager permissions support"""
     try:
-        user_to_edit = User.query.get_or_404(user_id)
+        user_to_edit = db.session.get(User, user_id)
+        if user_to_edit is None:
+            abort(404)
         
         # Track old role for permission cleanup
         old_role = user_to_edit.role
@@ -903,7 +905,9 @@ def reverse_geocode_api():
 def permanently_delete_user(user_id):
     """Permanently delete user but preserve associated QR codes (Admin only)"""
     try:
-        user_to_delete = User.query.get_or_404(user_id)
+        user_to_delete = db.session.get(User, user_id)
+        if user_to_delete is None:
+            abort(404)
         current_user = db.session.get(User, session['user_id'])
 
         # Security checks