From 2b6a78b99bc104a85e6c5cfe99d4d349b2674647 Mon Sep 17 00:00:00 2001
From: Ivo Oskamp <ivooskamp@oskamp.info>
Date: Mon, 12 Jan 2026 13:38:55 +0100
Subject: [PATCH] Auto-commit local changes before build (2026-01-12 13:38:55)

---
 .last-branch                                             | 2 +-
 .../backupchecks/src/backend/app/main/routes_inbox.py    | 9 ++++-----
 docs/changelog.md                                        | 8 ++++++++
 3 files changed, 13 insertions(+), 6 deletions(-)

diff --git a/.last-branch b/.last-branch
index 14aa591..be439dd 100644
--- a/.last-branch
+++ b/.last-branch
@@ -1 +1 @@
-v20260112-09-veeam-vspc-company-mapping-popup
+v20260112-10-fix-vspc-approve-endpoint-duplicate
diff --git a/containers/backupchecks/src/backend/app/main/routes_inbox.py b/containers/backupchecks/src/backend/app/main/routes_inbox.py
index fbbdfa7..0605a4a 100644
--- a/containers/backupchecks/src/backend/app/main/routes_inbox.py
+++ b/containers/backupchecks/src/backend/app/main/routes_inbox.py
@@ -282,12 +282,8 @@ def inbox_message_approve(message_id: int):
     return redirect(url_for("main.inbox"))
 
 
-@main_bp.route("/inbox/message/<int:message_id>/delete", methods=["POST"])
-@login_required
-@roles_required("admin", "operator")
-
-
 @main_bp.route("/inbox/<int:message_id>/approve_vspc_companies", methods=["POST"])
+@login_required
 @roles_required("admin", "operator")
 def inbox_message_approve_vspc_companies(message_id: int):
     msg = MailMessage.query.get_or_404(message_id)
@@ -434,6 +430,9 @@ def inbox_message_approve_vspc_companies(message_id: int):
 
 
 
+@main_bp.route("/inbox/message/<int:message_id>/delete", methods=["POST"])
+@login_required
+@roles_required("admin", "operator")
 def inbox_message_delete(message_id: int):
     msg = MailMessage.query.get_or_404(message_id)
 
diff --git a/docs/changelog.md b/docs/changelog.md
index c795404..61525d5 100644
--- a/docs/changelog.md
+++ b/docs/changelog.md
@@ -184,6 +184,14 @@
 - Ensured only alarms and objects belonging to the selected company are attached to the corresponding run.
 - Disabled the standard job approval flow for this report type and replaced it with the company mapping workflow.
 
+---
+
+## v20260112-10-fix-vspc-approve-endpoint-duplicate
+
+- Fixed a Flask startup crash caused by duplicate endpoint registration for the VSPC company approve route.
+- Corrected misplaced route decorators that caused the approve handler to be mapped to the delete endpoint.
+- Restored proper route separation between inbox message delete and VSPC company approve actions.
+- Added missing authentication requirement to the VSPC approve endpoint to align with other inbox actions.
 ================================================================================================================================================
 ## v0.1.19
 This release delivers a broad set of improvements focused on reliability, transparency, and operational control across mail processing, administrative auditing, and Run Checks workflows. The changes aim to make message handling more robust, provide better insight for administrators, and give operators clearer and more flexible control when reviewing backup runs.