05/25 Improvement 1

app/routes/issues.py

@@ -180,6 +180,8 @@ def view(issue_id):
         if not facility or facility.id not in cids:
             flash('Access denied.', 'danger')
             return redirect(url_for('issues.index'))
+        if request.method == 'POST':
+            abort(403)
 
     form  = IssueUpdateForm(obj=issue)
     staff = User.query.filter(User.role.in_(['admin', 'director', 'inspector'])).order_by(User.username).all()
@@ -542,6 +544,41 @@ def verify(issue_id):
     return redirect(url_for('issues.view', issue_id=issue_id))
 
 
+@bp.route('/bulk-verify', methods=['POST'])
+@login_required
+@supervisor_required
+def bulk_verify():
+    """Verify multiple pending-verification issues in a single action."""
+    issue_ids = request.form.getlist('issue_ids', type=int)
+    if not issue_ids:
+        flash('No issues selected.', 'warning')
+        return redirect(url_for('issues.verification_queue'))
+
+    verified_count = 0
+    for issue_id in issue_ids:
+        issue = db.session.get(Issue, issue_id)
+        if issue is None or issue.status not in ('resolved', 'pending_verification'):
+            continue
+        issue.status            = 'resolved'
+        issue.verified_by       = current_user.id
+        issue.verified_at       = now_eastern()
+        if not issue.resolved_at:
+            issue.resolved_at   = now_eastern()
+        verified_count += 1
+
+    if verified_count:
+        db.session.commit()
+        for issue_id in issue_ids:
+            issue = db.session.get(Issue, issue_id)
+            if issue and issue.verified_by == current_user.id:
+                log_action(ACTION_UPDATE, 'Issue', issue_id,
+                           f'#{issue_id}',
+                           f'bulk_verified_by={current_user.username}')
+
+    flash(f'{verified_count} issue{"s" if verified_count != 1 else ""} verified and closed.', 'success')
+    return redirect(url_for('issues.verification_queue'))
+
+
 @bp.route('/<int:issue_id>/request-verification', methods=['POST'])
 @login_required
 def request_verification(issue_id):