fix(measure): filtro stazione anche su barcode, avvio sequenza e task_execute (#24)

_recipe_allowed_at_station() riusa get_station_recipes() (stessa fonte di
/measure/select) per lookup_barcode, start_sequence e task_execute: prima
solo l'elenco filtrava, il barcode e i link diretti lasciavano misurare
ricette non assegnate alla stazione. Ricetta non assegnata -> abort(403)
con messaggio "ricetta non assegnata a questa stazione" (pagine, come già
fa role_required) o JSON 403 (lookup-barcode). Aggiornati i test esistenti
che ora richiedono get_station_recipes/STATION_CODE mockati.
Backend (ruoli sui run, StationRecipeAssignment su open_run) resta al
lotto A1.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/frontend/flask_app/blueprints/measure.py

@@ -1,6 +1,6 @@
 """MeasurementTec blueprint - recipe selection and measurement execution."""
 from flask import (
-    Blueprint, flash, jsonify, redirect, render_template,
+    Blueprint, abort, flash, jsonify, redirect, render_template,
     request, session, url_for,
 )
 from flask_babel import gettext as _
@@ -182,6 +182,32 @@ def _current_run_id() -> int | None:
     return resp.get("id")
 
 
+def _recipe_allowed_at_station(recipe_id: int) -> bool:
+    """Is this recipe among the ones the picker shows for the current station? (#24)
+
+    The picker (/measure/select) already filters through
+    get_station_recipes(); barcode lookup, the guided-sequence shortcut and a
+    direct link into task_execute all bypass that page, so without this check
+    an operator could measure a recipe never assigned to this station just by
+    knowing (or scanning) its code. Same source of truth, same call - no
+    separate policy to keep in sync. Anything we cannot confirm (no station
+    configured, the call failing) is refused, not let through.
+    """
+    station_code, _overridden = _current_station()
+    if not station_code:
+        return False
+    try:
+        resp = api_client.get_station_recipes(station_code)
+    except Exception:
+        return False
+    if isinstance(resp, dict) and resp.get("error"):
+        return False
+    recipes = resp.get("items", resp) if isinstance(resp, dict) else resp
+    if not isinstance(recipes, list):
+        return False
+    return any(isinstance(r, dict) and r.get("id") == recipe_id for r in recipes)
+
+
 # ---------------------------------------------------------------------------
 # Route: start the guided sequence
 # ---------------------------------------------------------------------------
@@ -207,6 +233,9 @@ def start_sequence(recipe_id: int):
         )
         return redirect(url_for("measure.select_recipe"))
 
+    if not _recipe_allowed_at_station(recipe_id):
+        abort(403, description=_("Ricetta non assegnata a questa stazione"))
+
     missing = _missing_traceability(recipe_resp, lot_number, serial_number)
     if missing:
         flash(
@@ -281,11 +310,14 @@ def task_execute(task_id: int):
         )
         return redirect(url_for("measure.select_recipe"))
 
+    recipe_id = task_resp.get("recipe_id")
+    if recipe_id and not _recipe_allowed_at_station(recipe_id):
+        abort(403, description=_("Ricetta non assegnata a questa stazione"))
+
     lot_number = session.get("lot_number", "")
     serial_number = session.get("serial_number", "")
 
     # Load all task IDs for this recipe (ordered) for auto-advance
-    recipe_id = task_resp.get("recipe_id")
     all_task_ids = []
     measurement_interval_minutes = None
     # Allowed until the recipe says otherwise: a recipe that could not be read must
@@ -405,6 +437,12 @@ def lookup_barcode():
             "detail": resp.get("detail", _("Ricetta non trovata")),
         }), 404
 
+    if not _recipe_allowed_at_station(resp.get("id")):
+        return jsonify({
+            "error": True,
+            "detail": _("Ricetta non assegnata a questa stazione"),
+        }), 403
+
     return jsonify(resp)