Aug 7 - Update: add external inspector

app/api/inspections.py

@@ -35,7 +35,8 @@ logger = logging.getLogger(__name__)
 
 bp = Blueprint('api_inspections', __name__)
 
-_ALLOWED_ROLES = {'admin', 'director', 'inspector', 'project_manager', 'auditor'}
+_ALLOWED_ROLES = {'admin', 'director', 'inspector', 'external_inspector',
+                  'project_manager', 'auditor'}
 
 
 def _merge_form_data(existing: dict, incoming: dict) -> dict:
@@ -135,7 +136,7 @@ def _resolve_schedule(schedule_id, user):
         logger.warning('API INSPECTIONS | unknown schedule id=%s from user=%s '
                        '— submitting unlinked', schedule_id, user.username)
         return None
-    if user.role == 'inspector' and sched.inspector_id != user.id:
+    if user.is_inspector and sched.inspector_id != user.id:
         logger.warning('API INSPECTIONS | schedule id=%s not assigned to user=%s '
                        '— submitting unlinked', schedule_id, user.username)
         return None
@@ -282,7 +283,7 @@ def list_inspections():
     query = Inspection.query
 
     # Inspectors only see their own inspections
-    if user.role == 'inspector':
+    if user.is_inspector:
         query = query.filter(Inspection.inspector_id == user.id)
 
     # Optional filters
@@ -613,7 +614,7 @@ def update_inspection(inspection_id):
     if inspection is None:
         return api_error('Inspection not found', 404)
 
-    if user.role == 'inspector' and inspection.inspector_id != user.id:
+    if user.is_inspector and inspection.inspector_id != user.id:
         return api_error('Access denied', 403)
 
     data = request.get_json(silent=True) or {}