Sep 15 - Update the check-in pages, employee id field limited to 4 digits/characters

routes/qr_codes.py

@@ -51,6 +51,11 @@ bp = Blueprint('qr_codes', __name__)
 # PT is accepted for backward compatibility with IDs created before the dropdown.
 VALID_CHECKIN_WORK_TYPES = ('SP', 'PW', 'PT', 'C')
 
+# Employee IDs entered on the check-in page are at most 4 digits. Keep in sync
+# with the maxlength on #employee_id, EMPLOYEE_ID_MAX_DIGITS in
+# qr_destination.html and QR_EMPLOYEE_ID_MAX_DIGITS in qr_destination.js.
+CHECKIN_EMPLOYEE_ID_MAX_DIGITS = 4
+
 # Bilingual labels for each work type, echoed back to the check-in page so the
 # submit button, the success card, and the check-out reminder all name the type
 # the same way the dropdown does. Keyed by code; '' is Regular (no code stored).
@@ -739,6 +744,21 @@ def qr_checkin(qr_url):
         # Get and validate employee ID
         employee_id = request.form.get('employee_id', '').strip()
 
+        # At most 4 digits — counted on the base ID, so an old-style typed
+        # suffix ("1234SP") from a page cached before the numeric-only rule
+        # still passes. Refused, never truncated: a shorter ID is another person.
+        if employee_id:
+            base_for_length, _ = parse_employee_id_for_work_type(employee_id)
+            if len(re.sub(r'\D', '', base_for_length)) > CHECKIN_EMPLOYEE_ID_MAX_DIGITS:
+                logger_handler.logger.warning(
+                    f"Check-in rejected: employee ID '{employee_id}' has more than "
+                    f"{CHECKIN_EMPLOYEE_ID_MAX_DIGITS} digits (QR {qr_url})"
+                )
+                return jsonify({
+                    'success': False,
+                    'message': 'Employee ID must be 4 digits or fewer. / El ID de empleado debe tener 4 dígitos o menos.'
+                }), 400
+
         # --- ADDED: type of work selected on the check-in page ---
         # The employee enters a numeric ID and picks a work type; the code is
         # appended to the ID so the stored value keeps the existing storage
@@ -1234,8 +1254,8 @@ def qr_last_work_type(qr_url):
             return _no_store_json(empty)
 
         employee_id = request.args.get('employee_id', '').strip()
-        # The check-in page allows digits only; anything else cannot be matched.
-        if not employee_id.isdigit():
+        # The check-in page allows up to 4 digits; anything else cannot be matched.
+        if not employee_id.isdigit() or len(employee_id) > CHECKIN_EMPLOYEE_ID_MAX_DIGITS:
             return _no_store_json(empty)
 
         selected_location_name = request.args.get('selected_location_name', '').strip()