05/25 Update inspectors contract assignment

app/api/issues.py

@@ -35,6 +35,7 @@ from app.api.decorators import jwt_required
 from app.utils.audit import log_action, ACTION_CREATE, ACTION_UPDATE
 from app.utils.notifications import notify_by_matrix
 from app.utils.time_utils import now_eastern
+from app.utils.scope import get_inspector_scope
 
 logger = logging.getLogger(__name__)
 
@@ -112,14 +113,13 @@ def list_issues():
     query = Issue.query
 
     if user.role == 'inspector':
-        # Inspectors see issues assigned to them OR issues they reported.
-        # The reported_by path covers issues created on the iPad that haven't
-        # been assigned yet (assigned_to is NULL until a director assigns them).
-        # Pre-phase18 rows with reported_by = NULL still surface via assigned_to.
-        query = query.filter(
+        fids = get_inspector_scope(user)
+        if not fids:
+            return api_ok({'issues': [], 'total': 0, 'limit': limit, 'offset': offset})
+        query = query.outerjoin(Area, Issue.area_id == Area.id).filter(
             db.or_(
-                Issue.assigned_to == user.id,
-                Issue.reported_by == user.id,
+                Issue.facility_id.in_(fids),
+                db.and_(Issue.area_id.isnot(None), Area.facility_id.in_(fids)),
             )
         )
     else:
@@ -204,6 +204,11 @@ def create_issue():
     if facility is None:
         return api_error('Facility not found', 404)
 
+    if user.role == 'inspector':
+        fids = get_inspector_scope(user)
+        if not fids or facility_id not in fids:
+            return api_error('Access denied — facility is not in your assigned contracts', 403)
+
     inspection_id = data.get('inspection_id')
     if inspection_id:
         inspection = db.session.get(Inspection, inspection_id)
@@ -290,8 +295,11 @@ def get_issue(issue_id):
     if issue is None:
         return api_error('Issue not found', 404)
 
-    if user.role == 'inspector' and issue.assigned_to != user.id and issue.reported_by != user.id:
-        return api_error('Access denied', 403)
+    if user.role == 'inspector':
+        fids     = get_inspector_scope(user)
+        facility = issue.resolved_facility
+        if not fids or not facility or facility.id not in fids:
+            return api_error('Access denied', 403)
 
     return api_ok(_issue_payload(issue))
 
@@ -320,8 +328,11 @@ def update_issue_status(issue_id):
     if issue is None:
         return api_error('Issue not found', 404)
 
-    if user.role == 'inspector' and issue.assigned_to != user.id and issue.reported_by != user.id:
-        return api_error('Access denied — you can only update issues assigned to or reported by you', 403)
+    if user.role == 'inspector':
+        fids     = get_inspector_scope(user)
+        facility = issue.resolved_facility
+        if not fids or not facility or facility.id not in fids:
+            return api_error('Access denied', 403)
 
     data       = request.get_json(silent=True) or {}
     new_status = (data.get('status') or '').strip().lower()
@@ -382,8 +393,11 @@ def update_issue_photos(issue_id):
     if issue is None:
         return api_error('Issue not found', 404)
 
-    if user.role == 'inspector' and issue.assigned_to != user.id and issue.reported_by != user.id:
-        return api_error('Access denied', 403)
+    if user.role == 'inspector':
+        fids     = get_inspector_scope(user)
+        facility = issue.resolved_facility
+        if not fids or not facility or facility.id not in fids:
+            return api_error('Access denied', 403)
 
     data = request.get_json(silent=True) or {}
     raw  = data.get('result_photos')