diff --git a/app/routes/facilities.py b/app/routes/facilities.py index b70ef55..4e5f0a5 100644 --- a/app/routes/facilities.py +++ b/app/routes/facilities.py @@ -191,16 +191,17 @@ def facility_qr_regenerate(facility_id): def facility_qr_print_all(): """Printable sheet of QR codes for all facilities the user can see. - Optional ?contract_id= limits the sheet to one contract. Inspectors are - scoped to their contracted facilities; customers to their assigned - facilities; managers see all active facilities. + Optional ?contract_id= limits the sheet to one contract. Inspectors have + no QR management (403); customers are scoped to their assigned facilities; + managers see all active facilities. """ + # QR management is not an inspector task. + if current_user.role == 'inspector': + abort(403) + contract_id = request.args.get('contract_id', type=int) - if current_user.role == 'inspector': - fids = get_inspector_scope(current_user) or [] - query = Facility.query.filter(Facility.id.in_(fids), Facility.active == True) - elif current_user.role == 'customer': + if current_user.role == 'customer': fids = get_customer_scope(current_user) or [] query = Facility.query.filter(Facility.id.in_(fids), Facility.active == True) else: diff --git a/app/templates/facilities/list.html b/app/templates/facilities/list.html index e3ce050..0eb779e 100644 --- a/app/templates/facilities/list.html +++ b/app/templates/facilities/list.html @@ -8,10 +8,12 @@

Facilities

+ {% if current_user.role != 'inspector' %} Print All QR Codes + {% endif %} {% if current_user.role in ['admin', 'director'] %} Add Facility