Aug 6 - Add external inspector role

app/api/scheduled.py

@@ -32,7 +32,8 @@ logger = logging.getLogger(__name__)
 
 bp = Blueprint('api_scheduled', __name__)
 
-_ALLOWED_ROLES = {'admin', 'director', 'inspector', 'project_manager', 'auditor'}
+_ALLOWED_ROLES = {'admin', 'director', 'inspector', 'external_inspector',
+                  'project_manager', 'auditor'}
 
 
 def _scheduled_payload(s):
@@ -107,7 +108,7 @@ def list_scheduled():
 
     query = ScheduledInspection.query.filter(ScheduledInspection.active.is_(True))
 
-    if user.role == 'inspector':
+    if user.is_inspector:
         # Inspectors only see schedules assigned directly to them.
         query = query.filter(ScheduledInspection.inspector_id == user.id)
 
@@ -161,7 +162,8 @@ def create_follow_up():
     user = g.api_user
 
     # Auditor is read-only everywhere else; keep it that way here.
-    if user.role not in {'admin', 'director', 'inspector', 'project_manager'}:
+    if user.role not in {'admin', 'director', 'inspector', 'external_inspector',
+                         'project_manager'}:
         return api_error('Access denied', 403)
 
     body = request.get_json(silent=True) or {}
@@ -177,7 +179,7 @@ def create_follow_up():
     # An inspector may only schedule a follow-up of their own work, and only
     # within their assigned contracts — the same two gates the rest of the
     # mobile API applies. Managers are unrestricted, matching the web.
-    if user.role == 'inspector':
+    if user.is_inspector:
         if parent.inspector_id != user.id:
             return api_error('Access denied', 403)
         fids = get_inspector_scope(user)