Aug 19 - Update New Inspection Schedule page layout

app/routes/inspections.py

@@ -476,10 +476,23 @@ def areas_for_facility(facility_id):
 @bp.route('/facilities_for_project/<int:project_id>')
 @login_required
 def facilities_for_project(project_id):
-    facilities = (Facility.query
-                  .filter_by(active=True, project_id=project_id)
-                  .order_by(Facility.name)
-                  .all())
+    """Active facilities on one contract, for the Contract -> Facility cascade.
+
+    **Scoped to the caller.** Every page that renders a facility dropdown
+    already limits it to what the viewer may see; this endpoint refills that
+    same dropdown, so without the same scope it would happily list another
+    customer's building names to anyone who guessed a contract id — the leak
+    rule 96 describes on the mobile API. Empty list rather than 403, so it does
+    not confirm whether the contract exists either.
+    """
+    q = Facility.query.filter_by(active=True, project_id=project_id)
+    if current_user.is_inspector:
+        fids = get_inspector_scope(current_user) or []
+        q = q.filter(Facility.id.in_(fids)) if fids else q.filter(False)
+    elif current_user.role == 'customer':
+        fids = get_customer_scope(current_user) or []
+        q = q.filter(Facility.id.in_(fids)) if fids else q.filter(False)
+    facilities = q.order_by(Facility.name).all()
     return jsonify([{'id': f.id, 'name': f.name} for f in facilities])