Security hardening, multi-site portability, and a documentation and API-surface sweep

plugins/printedparts/frontend/views/PartsKiosk.vue

@@ -97,7 +97,7 @@ import { withBase } from '@/utils/basePath'
 import TouchKeypad from '@/components/TouchKeypad.vue'
 
 // Leading text on the physical labels, shown before the number box so operators
-// type only the digits. It was hardcoded to 'WJ', which is West Jefferson's tag
+// type only the digits. It was hardcoded to 'WJ', which is one site's tag
 // format and nobody else's - on another site's kiosk it told operators to expect
 // letters that are not on their labels. Display only: the lookup sends whatever
 // was typed, unprefixed.

plugins/printedparts/frontend/views/PrintedPartsLabels.vue

@@ -52,7 +52,7 @@
 
 <script setup>
 import { ref, computed, onMounted, watch } from 'vue'
-import QRCode from 'qrcode'
+import { qrPngDataUrl } from '@/utils/codes'
 import { printedpartsApi } from '@/api'
 
 const items = ref([])
@@ -123,9 +123,7 @@ watch(printLabels, async labels => {
   await Promise.all(labels.map(async (label, index) => {
     // margin 2 = quiet zone (scannability); EC 'M' keeps modules big for the
     // short payload on tiny media; no logo overlay on a 0.36in code.
-    urls[index] = await QRCode.toDataURL(labelPayload(label), {
-      margin: 2, errorCorrectionLevel: 'M', width: 160
-    })
+    urls[index] = await qrPngDataUrl(labelPayload(label), { margin: 2, width: 160 })
   }))
   qrDataUrls.value = urls
 }, { deep: true, immediate: true })