05/25 Improvement 1

app/api/issues.py

@@ -23,6 +23,7 @@ PATCH /api/v1/issues/<id>/status
 """
 
 import logging
+import re
 
 from flask import Blueprint, request, g, current_app
 from app import db
@@ -42,6 +43,10 @@ bp = Blueprint('api_issues', __name__)
 _ALLOWED_ROLES  = {'admin', 'director', 'inspector', 'project_manager'}
 _VALID_SEVERITY = {'low', 'medium', 'high', 'critical'}
 _VALID_STATUSES = {'open', 'in_progress', 'resolved', 'pending_verification'}
+_UUID_RE = re.compile(
+    r'^[0-9a-f]{8}-?[0-9a-f]{4}-?[0-9a-f]{4}-?[0-9a-f]{4}-?[0-9a-f]{12}$',
+    re.IGNORECASE,
+)
 
 
 def _issue_payload(issue):
@@ -175,6 +180,8 @@ def create_issue():
     # ── Idempotency check ─────────────────────────────────────────────────
     mobile_local_id = data.get('mobile_local_id')
     if mobile_local_id:
+        if not _UUID_RE.match(str(mobile_local_id)):
+            return api_error('mobile_local_id must be a valid UUID', 400)
         existing = Issue.query.filter_by(mobile_local_id=mobile_local_id).first()
         if existing:
             logger.info('API ISSUES | duplicate | local_id=%s | issue_id=%d | user=%s',