05/25 Update inspectors contract assignment

app/api/facilities.py

@@ -23,7 +23,7 @@ from app.models.facility import Facility, Area
 from app.models.project import Project
 from app.api.errors import api_ok, api_error
 from app.api.decorators import jwt_required
-from app.utils.scope import get_customer_scope
+from app.utils.scope import get_customer_scope, get_inspector_scope
 
 logger = logging.getLogger(__name__)
 
@@ -92,27 +92,35 @@ def list_facilities():
     """
     user = g.api_user
 
-    # Customer role: honour facility-level scoping
-    facility_ids = get_customer_scope(user)
+    customer_fids  = get_customer_scope(user)
+    inspector_fids = get_inspector_scope(user)
 
-    if facility_ids is not None:
+    if customer_fids is not None:
         # Customer — scope to assigned facilities only
-        if not facility_ids:
+        if not customer_fids:
             logger.info('API FACILITIES | user=%s | role=customer | no_assignments',
                         user.username)
             return api_ok({'facilities': [], 'count': 0})
-
         facilities = (
             Facility.query
-            .filter(
-                Facility.id.in_(facility_ids),
-                Facility.active == True,   # noqa: E712
-            )
+            .filter(Facility.id.in_(customer_fids), Facility.active == True)
+            .order_by(Facility.name)
+            .all()
+        )
+    elif inspector_fids is not None:
+        # Inspector — scope to contracted facilities
+        if not inspector_fids:
+            logger.info('API FACILITIES | user=%s | role=inspector | no_assignments',
+                        user.username)
+            return api_ok({'facilities': [], 'count': 0})
+        facilities = (
+            Facility.query
+            .filter(Facility.id.in_(inspector_fids), Facility.active == True)
             .order_by(Facility.name)
             .all()
         )
     else:
-        # Internal staff — all active facilities
+        # All other staff — all active facilities
         facilities = (
             Facility.query
             .filter(Facility.active == True)   # noqa: E712
@@ -159,9 +167,14 @@ def list_areas(facility_id):
     if facility is None or not facility.active:
         return api_error('Facility not found', 404)
 
-    # Customer scope validation — ensure the customer is assigned to this facility
-    facility_ids = get_customer_scope(user)
-    if facility_ids is not None and facility_id not in facility_ids:
+    # Scope validation — customers and inspectors may only access their facilities
+    customer_fids  = get_customer_scope(user)
+    inspector_fids = get_inspector_scope(user)
+    if customer_fids is not None and facility_id not in customer_fids:
+        logger.warning('API FACILITIES/AREAS | access denied | user=%s | facility_id=%d',
+                       user.username, facility_id)
+        return api_error('Access denied', 403)
+    if inspector_fids is not None and facility_id not in inspector_fids:
         logger.warning('API FACILITIES/AREAS | access denied | user=%s | facility_id=%d',
                        user.username, facility_id)
         return api_error('Access denied', 403)