05/02 Phase B

app/__init__.py

@@ -147,24 +147,25 @@ def create_app(config_name='default'):
     app.register_blueprint(customers.bp)
     app.register_blueprint(scheduled_reports.bp)
 
-    # ── Mobile API (Phase 7 / Phase A) ──────────────────────────────────────
+    # ── Mobile API (Phase 7 / Phase A / Phase B) ─────────────────────────────
     # The /api/v1 blueprint group uses JWT Bearer tokens — no CSRF cookies needed.
     #
     # Flask-WTF's _is_exempt() checks whether the *leaf* blueprint object
-    # (e.g. api_auth, api_facilities) is in _exempt_blueprints.  Exempting
-    # the parent api_bp alone does NOT cascade to its sub-blueprints because
-    # request.blueprint returns the dotted child name ('api.api_auth'), and
-    # current_app.blueprints maps that to the child Blueprint object — which
-    # is never equal to the parent object in the exempt set.
-    #
-    # Fix: import every child blueprint object and exempt each one explicitly.
+    # is in _exempt_blueprints.  Exempting the parent api_bp does NOT cascade
+    # to sub-blueprints.  Each child blueprint must be exempted individually.
     from app.api import register_api, api_bp
     from app.api.auth        import bp as _api_auth_bp
     from app.api.facilities  import bp as _api_facilities_bp
     from app.api.templates   import bp as _api_templates_bp
+    from app.api.inspections import bp as _api_inspections_bp
+    from app.api.issues      import bp as _api_issues_bp
+    from app.api.photos      import bp as _api_photos_bp
     csrf.exempt(_api_auth_bp)
     csrf.exempt(_api_facilities_bp)
     csrf.exempt(_api_templates_bp)
+    csrf.exempt(_api_inspections_bp)
+    csrf.exempt(_api_issues_bp)
+    csrf.exempt(_api_photos_bp)
     register_api(app)
 
     # ── Error handler: 413 Request Entity Too Large ───────────────────────