Jul 8 - Implement QR code per facility

app/routes/facilities.py

@@ -70,6 +70,7 @@ def create_facility():
             active=form.active.data
         )
 
+        facility.ensure_public_token()   # QR landing-page token
         db.session.add(facility)
         db.session.commit()
         logger.info('FACILITIES | create | user=%s | facility_id=%s name=%r',
@@ -95,6 +96,61 @@ def view_facility(facility_id):
     areas = facility.areas.order_by(Area.name).all()
     return render_template('facilities/view.html', facility=facility, areas=areas)
 
+
+# ── Public QR code (staff-only generation) ────────────────────────────────────
+
+def _public_facility_url(facility):
+    """Absolute URL the QR encodes — the login-free occupant summary page."""
+    facility.ensure_public_token()
+    if not facility.public_token:
+        return None
+    return url_for('public.facility_summary',
+                   token=facility.public_token, _external=True)
+
+
+@bp.route('/<int:facility_id>/qr.png')
+@login_required
+def facility_qr_png(facility_id):
+    """Return the facility's QR code as a PNG image (staff only)."""
+    if current_user.role == 'customer':
+        abort(403)
+    facility = db.session.get(Facility, facility_id)
+    if facility is None:
+        abort(404)
+
+    # Token may not exist for pre-phase34 rows viewed before any commit.
+    created = not facility.public_token
+    url = _public_facility_url(facility)
+    if created:
+        db.session.commit()
+
+    import io
+    import qrcode
+    img = qrcode.make(url, box_size=10, border=2)
+    buf = io.BytesIO()
+    img.save(buf, format='PNG')
+    buf.seek(0)
+
+    from flask import Response
+    return Response(buf.getvalue(), mimetype='image/png', headers={
+        'Cache-Control': 'private, max-age=3600',
+    })
+
+
+@bp.route('/<int:facility_id>/qr')
+@login_required
+def facility_qr_page(facility_id):
+    """Printable page: facility name + QR + public URL + posting instructions."""
+    if current_user.role == 'customer':
+        abort(403)
+    facility = db.session.get(Facility, facility_id)
+    if facility is None:
+        abort(404)
+    public_url = _public_facility_url(facility)
+    db.session.commit()   # persist token if it was just generated
+    return render_template('facilities/qr.html',
+                           facility=facility, public_url=public_url)
+
 @bp.route('/<int:facility_id>/edit', methods=['GET', 'POST'])
 @login_required
 @supervisor_required