05/25 Improvement 1

app/api/inspections.py

@@ -17,6 +17,7 @@ GET   /api/v1/inspections
 
 import logging
 import json
+import re
 
 from flask import Blueprint, request, g
 from app import db
@@ -33,6 +34,10 @@ logger = logging.getLogger(__name__)
 bp = Blueprint('api_inspections', __name__)
 
 _ALLOWED_ROLES = {'admin', 'director', 'inspector', 'project_manager'}
+_UUID_RE = re.compile(
+    r'^[0-9a-f]{8}-?[0-9a-f]{4}-?[0-9a-f]{4}-?[0-9a-f]{4}-?[0-9a-f]{12}$',
+    re.IGNORECASE,
+)
 
 
 def _parse_datetime(value):
@@ -213,6 +218,8 @@ def create_inspection():
     # ── Idempotency check ─────────────────────────────────────────────────
     mobile_local_id = data.get('mobile_local_id')
     if mobile_local_id:
+        if not _UUID_RE.match(str(mobile_local_id)):
+            return api_error('mobile_local_id must be a valid UUID', 400)
         existing = Inspection.query.filter_by(mobile_local_id=mobile_local_id).first()
         if existing:
             logger.info('API INSPECTIONS | duplicate | local_id=%s | inspection_id=%d | user=%s',