Sep 18 - Update dashboard, PMs will see the QR codes of their assigned projects/buidlings only

routes/dashboard.py

@@ -8,7 +8,7 @@ Routes: /dashboard, /project/<id>/qr-codes, /dashboard/search,
 """
 from flask import abort, Blueprint, render_template, request, redirect, flash, session, jsonify, url_for
 from datetime import datetime, timedelta, date, time
-from sqlalchemy import or_
+from sqlalchemy import and_
 
 from extensions import db, logger_handler
 from models.attendance import AttendanceData
@@ -29,6 +29,11 @@ def _project_manager_qr_filter():
     if not is_pm:
         return False, None
 
+    # AND, not OR — the same rule the Attendance Report applies
+    # (_attendance_filter_conditions in routes/attendance.py): the assigned
+    # projects, narrowed to the assigned locations when there are any.
+    # With OR, a PM assigned location "Bldg A" also saw every OTHER project's
+    # QR codes that happened to use that same location name (Set 28).
     scope = []
     if allowed_project_ids:
         scope.append(QRCode.project_id.in_(allowed_project_ids))
@@ -36,7 +41,7 @@ def _project_manager_qr_filter():
         scope.append(QRCode.location.in_(allowed_location_names))
     if not scope:
         return True, QRCode.id.is_(None)  # assigned nothing → sees nothing
-    return True, or_(*scope)
+    return True, and_(*scope)
 
 bp = Blueprint('dashboard', __name__)
 
@@ -220,7 +225,7 @@ def dashboard_stats_api():
                 project_base_query = project_base_query.filter(Project.id.is_(None))
             if allowed_location_names:
                 attendance_scope.append(AttendanceData.location_name.in_(allowed_location_names))
-            attendance_condition = or_(*attendance_scope) if attendance_scope else AttendanceData.id.is_(None)
+            attendance_condition = and_(*attendance_scope) if attendance_scope else AttendanceData.id.is_(None)
             attendance_base_query = attendance_base_query.filter(attendance_condition)
             location_base_query = location_base_query.filter(attendance_condition)
 
@@ -298,8 +303,8 @@ def dashboard_realtime_api():
                 ))
             if allowed_location_names:
                 recent_scope.append(AttendanceData.location_name.in_(allowed_location_names))
-            recent_query = recent_query.filter(or_(*recent_scope) if recent_scope
-                                               else AttendanceData.id.is_(None))
+            recent_query = recent_query.filter(and_(*recent_scope) if recent_scope
+                                                else AttendanceData.id.is_(None))
 
         recent_activity = recent_query.order_by(
             AttendanceData.check_in_date.desc(),