05/02/2026 Updates for iPad app: Phase 1 - fix token getting issue 2

app/api/__init__.py

@@ -45,17 +45,19 @@ def register_api(app):
     register api_bp on the Flask app.
 
     Called once from create_app() in app/__init__.py.
+
+    NOTE: CSRF exemption for each sub-blueprint is handled in app/__init__.py
+    before this function is called, because csrf.exempt() must receive the
+    child Blueprint object directly — exempting the parent api_bp does not
+    cascade to its sub-blueprints.
     """
-    # ── Phase 1 (Web): Auth ──────────────────────────────────────────────
+    # ── Phase 7 (Web): Auth ──────────────────────────────────────────────
     from app.api.auth import bp as auth_bp
     api_bp.register_blueprint(auth_bp)
 
     # ── Phase A (iPad): Reference data ──────────────────────────────────
     from app.api.facilities import bp as facilities_bp
     from app.api.templates  import bp as templates_bp
-    from app import csrf
-    csrf.exempt(facilities_bp)
-    csrf.exempt(templates_bp)
     api_bp.register_blueprint(facilities_bp)
     api_bp.register_blueprint(templates_bp)