USB kiosk: guest check-out/check-in without a login

plugins/usb/plugin.py

@@ -70,6 +70,44 @@ class USBPlugin(BasePlugin):
             'docs': 'plugins/usb/README.md',
         }
 
+    def get_settings_defaults(self) -> List[Dict]:
+        """Kiosk settings.
+
+        The kiosk is an UNAUTHENTICATED write, so it ships off and a site turns
+        it on deliberately. Opening that door is a decision about the door.
+        """
+        return [
+            {
+                'key': 'usb_kiosk_enabled',
+                'value': 'false',
+                'valuetype': 'boolean',
+                'category': 'usb',
+                # Public: the kiosk page runs logged out and has to be able to
+                # tell "turned off" from "broken" before anyone signs in.
+                'public': True,
+                'description': 'Allow check-out and check-in from the logged-out '
+                               'USB kiosk screen (/usb-kiosk). Off by default: the '
+                               'kiosk writes without a login, attributing every '
+                               'action to a scanned badge instead. It can only move '
+                               'a device between checked-out and checked-in - it '
+                               'cannot add, edit, retire or list devices.',
+            },
+            {
+                'key': 'usb_kiosk_allow_return_for_others',
+                'value': 'true',
+                'valuetype': 'boolean',
+                'category': 'usb',
+                'public': True,
+                'description': 'At the kiosk, allow somebody to return a device '
+                               'checked out to a DIFFERENT person after confirming. '
+                               'The returning badge is what gets recorded, so the '
+                               'log shows who actually handed it back. Turn this '
+                               'off to refuse any mismatch outright - a device left '
+                               'behind by someone on leave then needs a signed-in '
+                               'user to return it.',
+            },
+        ]
+
     def get_config_schema(self) -> List[Dict]:
         """CMMC USB check-in/out database connection. Host/name/user are settings
         the wizard can edit; the password stays in .env (emitted, not stored)."""