05/02/2026 Updates for iPad app: Phase 1 - fix token getting issue 2

app/__init__.py

@@ -147,12 +147,24 @@ def create_app(config_name='default'):
     app.register_blueprint(customers.bp)
     app.register_blueprint(scheduled_reports.bp)
 
-    # ── Mobile API (Phase 7) ─────────────────────────────────────────────────
-    # The /api/v1 blueprint uses JWT Bearer tokens — no CSRF cookies needed.
-    # Exempt it from CSRFProtect before registering so POST /api/v1/* routes
-    # are never rejected for a missing CSRF token.
+    # ── Mobile API (Phase 7 / Phase A) ──────────────────────────────────────
+    # The /api/v1 blueprint group uses JWT Bearer tokens — no CSRF cookies needed.
+    #
+    # Flask-WTF's _is_exempt() checks whether the *leaf* blueprint object
+    # (e.g. api_auth, api_facilities) is in _exempt_blueprints.  Exempting
+    # the parent api_bp alone does NOT cascade to its sub-blueprints because
+    # request.blueprint returns the dotted child name ('api.api_auth'), and
+    # current_app.blueprints maps that to the child Blueprint object — which
+    # is never equal to the parent object in the exempt set.
+    #
+    # Fix: import every child blueprint object and exempt each one explicitly.
     from app.api import register_api, api_bp
-    csrf.exempt(api_bp)
+    from app.api.auth        import bp as _api_auth_bp
+    from app.api.facilities  import bp as _api_facilities_bp
+    from app.api.templates   import bp as _api_templates_bp
+    csrf.exempt(_api_auth_bp)
+    csrf.exempt(_api_facilities_bp)
+    csrf.exempt(_api_templates_bp)
     register_api(app)
 
     # ── Error handler: 413 Request Entity Too Large ───────────────────────