05/25 Update inspectors contract assignment

app/routes/inspections.py

@@ -23,7 +23,7 @@ from app.models.notification import (
     EVENT_CUSTOMER_INSPECTION_DONE, EVENT_CUSTOMER_ISSUE_UPDATED,
 )
 from app.utils.audit import log_action, ACTION_CREATE, ACTION_UPDATE, ACTION_DELETE, ACTION_EXPORT
-from app.utils.scope import get_customer_scope
+from app.utils.scope import get_customer_scope, get_inspector_scope
 
 bp = Blueprint('inspections', __name__, url_prefix='/inspections')
 
@@ -201,7 +201,11 @@ def index():
     q = Inspection.query.order_by(Inspection.inspection_date.desc())
 
     if current_user.role == 'inspector':
-        q = q.filter(Inspection.inspector_id == current_user.id)
+        fids = get_inspector_scope(current_user)
+        if not fids:
+            q = q.filter(False)
+        else:
+            q = q.filter(Inspection.facility_id.in_(fids))
     elif current_user.role == 'customer':
         customer_facility_ids = get_customer_scope(current_user)
         if not customer_facility_ids:
@@ -223,7 +227,10 @@ def index():
         ).filter(~Inspection.follow_ups.any())
 
     inspections = q.paginate(page=page, per_page=20, error_out=False)
-    if current_user.role == 'customer':
+    if current_user.role == 'inspector':
+        fids = get_inspector_scope(current_user) or []
+        facilities = Facility.query.filter(Facility.id.in_(fids), Facility.active == True).order_by(Facility.name).all()
+    elif current_user.role == 'customer':
         cids = get_customer_scope(current_user) or []
         facilities = Facility.query.filter(Facility.id.in_(cids), Facility.active == True).order_by(Facility.name).all()
     else:
@@ -248,6 +255,15 @@ def start():
     templates = InspectionTemplate.query.order_by(InspectionTemplate.name).all()
     projects  = Project.query.filter_by(active=True).order_by(Project.name).all()
 
+    # Scope projects to inspector's assigned contracts
+    if current_user.role == 'inspector':
+        from app.models.inspector_assignment import InspectorAssignment
+        assigned_pids = {
+            a.project_id for a in
+            InspectorAssignment.query.filter_by(user_id=current_user.id).all()
+        }
+        projects = [p for p in projects if p.id in assigned_pids]
+
     form.template_id.choices = [(t.id, t.name) for t in templates]
     form.project_id.choices  = [(p.id, p.name) for p in projects]
 
@@ -284,6 +300,13 @@ def start():
         if template is None:
             abort(404)
 
+        # Inspector facility scope check — prevent crafted POST from selecting
+        # a facility outside their assigned contracts.
+        if current_user.role == 'inspector':
+            fids = get_inspector_scope(current_user)
+            if not fids or form.facility_id.data not in fids:
+                abort(403)
+
         if not template.get_form_schema():
             flash('This template has no form fields yet. Please build the form in the template editor first.', 'warning')
             return redirect(url_for('inspections.start'))