Aug 27 - Add MySQL optimize and security check

app/routes/issues.py

@@ -166,13 +166,14 @@ def export_list_pdf():
             date_to_filter = ''
     if contract_filter.isdigit():
         _contract_fids = [
-            f.id for f in Facility.query.filter_by(project_id=int(contract_filter)).all()
+            fid for (fid,) in db.session.query(Facility.id)
+            .filter(Facility.project_id == int(contract_filter)).all()
         ]
         q = q.filter(db.or_(
             Issue.facility_id.in_(_contract_fids),
             Area.facility_id.in_(_contract_fids),
         )) if _contract_fids else q.filter(False)
-    if facility_filter:
+    if facility_filter.isdigit():
         fid = int(facility_filter)
         q = q.filter(db.or_(Issue.facility_id == fid, Area.facility_id == fid))
     if reporter_filter.isdigit():
@@ -201,7 +202,7 @@ def export_list_pdf():
         p = db.session.get(Project, int(contract_filter))
         if p:
             filter_parts.append(f'Contract: {p.name}')
-    if facility_filter:
+    if facility_filter.isdigit():
         f = db.session.get(Facility, int(facility_filter))
         if f:
             filter_parts.append(f'Facility: {f.name}')
@@ -303,7 +304,8 @@ def index():
             date_to_filter = ''
     if contract_filter.isdigit():
         _contract_fids = [
-            f.id for f in Facility.query.filter_by(project_id=int(contract_filter)).all()
+            fid for (fid,) in db.session.query(Facility.id)
+            .filter(Facility.project_id == int(contract_filter)).all()
         ]
         q = q.filter(db.or_(
             Issue.facility_id.in_(_contract_fids),
@@ -311,7 +313,7 @@ def index():
         )) if _contract_fids else q.filter(False)
     if reporter_filter.isdigit():
         q = q.filter(Issue.reported_by == int(reporter_filter))
-    if facility_filter:
+    if facility_filter.isdigit():
         fid = int(facility_filter)
         q = q.filter(
             db.or_(
@@ -338,8 +340,9 @@ def index():
     # can render the following badge and inline unfollow button without an
     # additional query per row.
     followed_ids = {
-        f.issue_id
-        for f in IssueFollower.query.filter_by(user_id=current_user.id).all()
+        iid for (iid,) in
+        db.session.query(IssueFollower.issue_id)
+        .filter(IssueFollower.user_id == current_user.id).all()
     }
 
     # Facilities for the filter dropdown — scoped for inspectors/customers,