Jul 10 - Update codes to catch up with the single tenant project

app/routes/facility_qr.py

@@ -25,7 +25,7 @@ In multi-tenant mode the printed URL is built from the tenant's own domain
 import logging
 from datetime import timedelta
 
-from flask import Blueprint, render_template, abort
+from flask import Blueprint, render_template, redirect, request, url_for, abort
 from flask_login import current_user
 from sqlalchemy import func, or_
 
@@ -135,6 +135,7 @@ def scan(token):
 
     return render_template(
         'facility_qr/view.html',
+        token                = token,
         facility             = facility,
         contract             = facility.project,
         total_90             = total_90,
@@ -154,3 +155,52 @@ def scan(token):
         can_view_full        = _can_view_full(facility),
         generated_at         = now,
     )
+
+
+@bp.route('/<token>/report', methods=['POST'])
+@limiter.limit('5 per hour')
+def report(token):
+    """Public occupant issue report submitted from the QR scan page.
+
+    No login required — the unguessable QR token is the sole authorization.
+    A honeypot field silently rejects bot submissions. Creates an Issue with
+    reported_by=None so staff know it came from a public form.
+    """
+    facility = Facility.query.filter_by(qr_token=token).first()
+    if facility is None or not facility.active:
+        abort(404)
+
+    # Honeypot — bots fill this field, humans leave it blank
+    if request.form.get('website', '').strip():
+        logger.warning('FACILITY QR REPORT | honeypot triggered | facility_id=%s', facility.id)
+        return redirect(url_for('facility_qr.scan', token=token) + '?reported=1')
+
+    description = request.form.get('description', '').strip()
+    severity    = request.form.get('severity', 'medium')
+
+    if not description:
+        return redirect(url_for('facility_qr.scan', token=token))
+    if severity not in ('low', 'medium', 'high'):
+        severity = 'medium'
+
+    issue = Issue(
+        facility_id = facility.id,
+        severity    = severity,
+        description = description,
+        status      = 'open',
+        reported_by = None,   # anonymous public submission
+    )
+    db.session.add(issue)
+    db.session.commit()
+
+    logger.info('FACILITY QR REPORT | facility_id=%s issue_id=%s severity=%s',
+                facility.id, issue.id, severity)
+
+    # Notify staff via the notification matrix (same event as Issues → Create)
+    try:
+        from app.utils.notifications import notify_by_matrix
+        notify_by_matrix('issue_created', issue_id=issue.id, facility_id=facility.id)
+    except Exception as exc:
+        logger.error('FACILITY QR REPORT | notify_failed | err=%s', exc)
+
+    return redirect(url_for('facility_qr.scan', token=token) + '?reported=1')