Shut the parts kiosk behind a device token, and stop the health probe leaking

tests/test_core/test_authz.py

@@ -46,10 +46,14 @@ EXEMPT_BLUEPRINTS = {'auth', 'collector', 'setup'}
 #     the same blueprint are JWT+permission gated and ARE swept.
 EXEMPT_ENDPOINTS = {'knowledgebase.track_click', 'users.update_user',
                     'geenforce.post_report',
-                    # Deliberately open kiosk write: decrement-only,
-                    # badge-attributed server-side. Decision record in
-                    # docs/proposals/printedparts-plugin.md; justification in
-                    # the plugin README.
+                    # Kiosk write. No JWT - the people at the bin have no
+                    # account - but no longer open: it needs the site's kiosk
+                    # flag AND the per-device token (X-Kiosk-Token), and 404s
+                    # without them. The badge only attributes the ledger row.
+                    # The old "physically rate-limited by being a touch screen"
+                    # justification did not survive a scanner: bare digits
+                    # enumerated the catalogue and the 422/200 split was an
+                    # oracle for real employee numbers.
                     'printedparts.kiosk_take',
                     # Deliberately open kiosk writes. NOT the same bar as the
                     # parts kiosk, and the difference is the point: these are

tests/test_core/test_public_read_surface.py

@@ -60,6 +60,9 @@ PUBLIC_ENDPOINTS = {
     'slides.feed', 'slides.serve_image',
 
     # Parts kiosk: one item by its code, and that item's picture.
+    # kiosk_item takes no JWT but is NOT open: same kiosk flag + device token
+    # as the write. Gating only the write would have left the enumeration
+    # oracle running against a kiosk a site had switched off.
     'printedparts.kiosk_item', 'printedparts.serve_item_image',
 
     # USB kiosk.