Aug 27 - Add MySQL optimize and security check

app/routes/reports.py

@@ -74,23 +74,29 @@ def index():
     if current_user.role in ('admin', 'director', 'project_manager'):
         inspector_filter = request.args.get('inspector_id', type=int) or None
 
-    # Pre-compute inspection ID sets used by _scope_issue to avoid join conflicts.
-    inspector_inspection_ids = []   # own inspections (inspector role)
-    filter_inspection_ids    = None # filtered inspector's inspections (admin/dir/PM)
+    # Scope issues by the relevant inspector's inspections, as a SUBQUERY rather
+    # than a materialised id list. The previous form pulled every inspection id
+    # that inspector had ever performed into Python and sent them straight back
+    # as a literal IN (1, 2, 3, ... N): the round trip is wasted, the statement
+    # grows without bound with the inspector's history, and a long enough list
+    # eventually trips max_allowed_packet. A subquery is also still a single
+    # statement, so the "avoid join conflicts" reason for pre-computing holds.
+    #
+    # IN (empty subquery) already matches nothing, so the explicit empty-list
+    # guards the old code needed are gone rather than merely moved.
+    inspector_insp_subq = None
     if is_inspector:
-        inspector_inspection_ids = [
-            row[0] for row in
+        inspector_insp_subq = (
             db.session.query(Inspection.id)
             .filter(Inspection.inspector_id == current_user.id)
-            .all()
-        ]
+            .scalar_subquery()
+        )
     elif inspector_filter:
-        filter_inspection_ids = [
-            row[0] for row in
+        inspector_insp_subq = (
             db.session.query(Inspection.id)
             .filter(Inspection.inspector_id == inspector_filter)
-            .all()
-        ]
+            .scalar_subquery()
+        )
 
     def _scope_insp(q):
         if is_inspector:
@@ -104,14 +110,8 @@ def index():
         return q
 
     def _scope_issue(q):
-        if is_inspector:
-            if not inspector_inspection_ids:
-                return q.filter(False)
-            return q.filter(Issue.inspection_id.in_(inspector_inspection_ids))
-        if filter_inspection_ids is not None:
-            if not filter_inspection_ids:
-                return q.filter(False)
-            return q.filter(Issue.inspection_id.in_(filter_inspection_ids))
+        if inspector_insp_subq is not None:
+            return q.filter(Issue.inspection_id.in_(inspector_insp_subq))
         if customer_facility_ids is not None:
             if not customer_facility_ids:
                 return q.filter(False)