Sep 18 - Update dashboard, PMs will see the QR codes of their assigned projects/buidlings only

Claude.md

@@ -218,6 +218,12 @@ no assignments, or a permission lookup error, sees nothing). Applied in:
   `time_attendance_locations_api`, `search_employees_api`, `get_project_locations_api`
 - `routes/dashboard.py`: dashboard QR list + project list, `project_qr_codes` (403-style redirect
   for someone else's project), `dashboard_stats_api`, `dashboard_realtime_api`
+- **Projects and locations combine with AND, never OR** (Set 28) — assigned projects, narrowed to
+  the assigned locations when there are any. The report has always worked this way
+  (`_attendance_filter_conditions`); the dashboard used OR, so a PM assigned location "Bldg A"
+  also saw every OTHER project's QR codes that used that same location name.
+  A PM with locations but **no** project assignment still sees those locations across projects —
+  that is the only way such a user sees anything at all
 - A PM scoped only by **locations** is resolved to the projects behind those locations when
   employee names are searched, so their filter still works without exposing other projects.
 - **Any new endpoint returning attendance, employee, QR or project rows must call it.**
@@ -1417,6 +1423,14 @@ it (the workers share no pub/sub).
 | `app.py` | `CURRENT_YEAR` from local time |
 | — | Verified offline (42 checks): 16 date cases + 6 rejections, partial-batch rollback against a fake session, PM scope loading, scoped vs unscoped SQL for both locations APIs (values bound as parameters), empty result for an unassigned PM, 9 manual-ID cases, and no `utcnow()` left in the two route files. Suites still green: 71 (step 1), 24 (overtime), 38 (work-type IDs). Not run against MySQL or a browser |
 
+
+### Set 28 — Dashboard Showed a PM Other Projects' QR Codes (Sept 18, 2026)
+| File | Fix |
+|---|---|
+| `routes/dashboard.py` | `_project_manager_qr_filter()` combined the assigned projects and locations with `or_`, so a PM assigned a location saw every project's QR codes carrying that location name. Now `and_`, matching the Attendance Report (§4). The same OR appeared in `dashboard_stats_api` and `dashboard_realtime_api` (counts and recent activity) — both switched too; `or_` is no longer imported |
+| — | Verified against the real models on in-memory SQLite, committed vs edited module: PM with project Alpha + location "Bldg A" went from `A1, A2, B1` (B1 belongs to project Beta) to `A1`; project-only PM unchanged (`A1, A2`); location-only PM unchanged (`A1, B1`); PM with no assignments sees nothing; admin unfiltered. The Set 23/27 suites could not be re-run (scratch scripts from that session are gone), but the change is confined to `routes/dashboard.py`, which they do not cover |
+| — | Deploy: `routes/dashboard.py` only, then restart. No migration |
+
 ---
 
 ## 21. Infrastructure & Deployment