Aug 6 - Add external inspector role

app/routes/inspections.py

@@ -215,7 +215,7 @@ def index():
         joinedload(Inspection.area),
     ).order_by(Inspection.inspection_date.desc())
 
-    if current_user.role == 'inspector':
+    if current_user.is_inspector:
         fids = get_inspector_scope(current_user)
         if not fids:
             q = q.filter(False)
@@ -284,12 +284,12 @@ def index():
             q = q.filter(Inspection.overall_score <= float(score_max_filter))
         except ValueError:
             score_max_filter = ''
-    if inspector_filter.isdigit() and current_user.role != 'inspector':
+    if inspector_filter.isdigit() and not current_user.is_inspector:
         q = q.filter(Inspection.inspector_id == int(inspector_filter))
 
     inspections = q.paginate(page=page, per_page=20, error_out=False)
 
-    if current_user.role == 'inspector':
+    if current_user.is_inspector:
         fids = get_inspector_scope(current_user) or []
         _fq = Facility.query.filter(Facility.id.in_(fids), Facility.active == True)
     elif current_user.role == 'customer':
@@ -316,9 +316,9 @@ def index():
         projects = Project.query.filter_by(active=True).order_by(Project.name).all()
 
     # Inspector dropdown — shown to all roles except inspector (they only see their own)
-    if current_user.role != 'inspector':
+    if not current_user.is_inspector:
         inspectors = (User.query
-                      .filter(User.role == 'inspector', User.active == True)
+                      .filter(User.role.in_(User.INSPECTOR_ROLES), User.active == True)
                       .order_by(User.full_name, User.username).all())
     else:
         inspectors = []
@@ -352,7 +352,7 @@ def start():
     projects  = Project.query.filter_by(active=True).order_by(Project.name).all()
 
     # Scope projects to inspector's assigned contracts
-    if current_user.role == 'inspector':
+    if current_user.is_inspector:
         from app.models.inspector_assignment import InspectorAssignment
         assigned_pids = {
             a.project_id for a in
@@ -408,7 +408,7 @@ def start():
 
         # Inspector facility scope check — prevent crafted POST from selecting
         # a facility outside their assigned contracts.
-        if current_user.role == 'inspector':
+        if current_user.is_inspector:
             fids = get_inspector_scope(current_user)
             if not fids or form.facility_id.data not in fids:
                 abort(403)
@@ -472,7 +472,7 @@ def execute(inspection_id):
     if inspection is None:
         abort(404)
 
-    if current_user.role == 'inspector' and inspection.inspector_id != current_user.id:
+    if current_user.is_inspector and inspection.inspector_id != current_user.id:
         flash('Access denied.', 'danger')
         return redirect(url_for('inspections.index'))
 
@@ -609,7 +609,8 @@ def execute(inspection_id):
             return redirect(url_for('inspections.execute', inspection_id=inspection_id))
 
     staff_for_flag_issue = User.query.filter(
-        User.role.in_(['director', 'inspector', 'project_manager', 'auditor']),
+        User.role.in_(['director', 'inspector', 'external_inspector',
+                       'project_manager', 'auditor']),
         User.active == True,
     ).order_by(User.full_name, User.username).all()
 
@@ -649,7 +650,7 @@ def save_draft_ajax(inspection_id):
     if inspection is None:
         abort(404)
 
-    if current_user.role == 'inspector' and inspection.inspector_id != current_user.id:
+    if current_user.is_inspector and inspection.inspector_id != current_user.id:
         return jsonify({'ok': False, 'error': 'Access denied'}), 403
 
     if inspection.status == 'completed':
@@ -688,7 +689,7 @@ def upload_photo_ajax(inspection_id):
     if inspection is None:
         return jsonify({'ok': False, 'error': 'Not found'}), 404
 
-    if current_user.role == 'inspector' and inspection.inspector_id != current_user.id:
+    if current_user.is_inspector and inspection.inspector_id != current_user.id:
         return jsonify({'ok': False, 'error': 'Access denied'}), 403
 
     if inspection.status == 'completed':
@@ -715,7 +716,7 @@ def view(inspection_id):
     if inspection is None:
         abort(404)
 
-    if current_user.role == 'inspector' and inspection.inspector_id != current_user.id:
+    if current_user.is_inspector and inspection.inspector_id != current_user.id:
         flash('Access denied.', 'danger')
         return redirect(url_for('inspections.index'))
     if current_user.role == 'customer':
@@ -929,15 +930,20 @@ def flag_issue(inspection_id):
     if inspection is None:
         abort(404)
 
-    if current_user.role == 'inspector' and inspection.inspector_id != current_user.id:
+    if current_user.is_inspector and inspection.inspector_id != current_user.id:
         flash('Access denied.', 'danger')
         return redirect(url_for('inspections.index'))
 
     form  = IssueForm()
-    staff = User.query.filter(User.role.in_(['director', 'inspector'])).order_by(User.username).all()
+    staff = User.query.filter(
+        User.role.in_(['director', 'inspector', 'external_inspector'])
+    ).order_by(User.username).all()
 
     form.facility_id.choices = [(inspection.facility_id, inspection.facility.name)]
-    form.assigned_to.choices = [(0, '— Unassigned —')] + [(u.id, u.username) for u in staff]
+    form.assigned_to.choices = [(0, '— Unassigned —')] + [
+        (u.id, u.username + (' (External)' if u.is_external_inspector else ''))
+        for u in staff
+    ]
 
     if form.validate_on_submit():
         photo_path = _save_photo(form.photo.data, subfolder='issue_photos')
@@ -1019,7 +1025,7 @@ def export_list_pdf():
         joinedload(Inspection.area),
     ).order_by(Inspection.inspection_date.desc())
 
-    if current_user.role == 'inspector':
+    if current_user.is_inspector:
         fids = get_inspector_scope(current_user)
         if not fids:
             q = q.filter(False)
@@ -1082,7 +1088,7 @@ def export_list_pdf():
             q = q.filter(Inspection.overall_score <= float(score_max_filter))
         except ValueError:
             pass
-    if inspector_filter.isdigit() and current_user.role != 'inspector':
+    if inspector_filter.isdigit() and not current_user.is_inspector:
         q = q.filter(Inspection.inspector_id == int(inspector_filter))
 
     inspections = q.all()
@@ -1112,7 +1118,7 @@ def export_list_pdf():
         filter_parts.append(f'Min score: {score_min_filter}%')
     if score_max_filter:
         filter_parts.append(f'Max score: {score_max_filter}%')
-    if inspector_filter.isdigit() and current_user.role != 'inspector':
+    if inspector_filter.isdigit() and not current_user.is_inspector:
         u = db.session.get(User, int(inspector_filter))
         if u:
             filter_parts.append(f'Inspector: {u.display_name}')
@@ -1142,7 +1148,7 @@ def export_pdf(inspection_id):
     if inspection is None:
         abort(404)
 
-    if current_user.role == 'inspector' and inspection.inspector_id != current_user.id:
+    if current_user.is_inspector and inspection.inspector_id != current_user.id:
         flash('Access denied.', 'danger')
         return redirect(url_for('inspections.index'))
     if current_user.role == 'customer':