Sep 16 - Optimize code, part 2

utils/helpers.py

@@ -371,6 +371,35 @@ def roles_required(*allowed_roles):
     return decorator
 
 
+def load_project_manager_scope():
+    """
+    (is_project_manager, allowed_project_ids, allowed_location_names) for the
+    session user. Non-PMs get (False, [], []) and must NOT be filtered.
+
+    A PM may be scoped by projects, by locations, or both; empty lists for a PM
+    mean "no access at all" (fail closed), which is also what a permission
+    lookup failure returns. Used by the attendance APIs and the dashboard so a
+    PM cannot see other projects' locations, employees or scan activity (§4).
+    """
+    if session.get('role') != 'project_manager':
+        return False, [], []
+
+    from models.permissions import UserProjectPermission, UserLocationPermission
+
+    user_id = session.get('user_id')
+    try:
+        project_ids = [p.project_id for p in
+                       UserProjectPermission.query.filter_by(user_id=user_id).all()]
+        location_names = [l.location_name for l in
+                          UserLocationPermission.query.filter_by(user_id=user_id).all()]
+        return True, project_ids, location_names
+    except Exception as e:
+        logger_handler.logger.error(
+            f"Could not load Project Manager permissions for user {user_id}: {e}", exc_info=True
+        )
+        return True, [], []  # fail closed
+
+
 def restrict_blueprint_to_roles(blueprint, allowed_roles):
     """Apply the role check to every route of a blueprint (one line per module)."""
     @blueprint.before_request