From 30b7a5a8bf50e1aea74f1443e428f518daabe996 Mon Sep 17 00:00:00 2001 From: cproudlock Date: Wed, 2 Sep 2026 13:54:06 -0400 Subject: [PATCH] Correct the claim that the two kiosks are gated to the same bar Darkwing's reconnaissance flagged POST /api/printedparts/kiosk/take as an unauthenticated write reaching a ledger commit and an outbound mail/webhook trigger. Analysis dropped it, correctly: it is a declared exemption with a decision record. Nothing to fix in the code. The comment beside it was wrong, though. It described the USB kiosk writes as open at the "same bar as the parts kiosk" while listing a gate the parts kiosk does not have: usb_kiosk_enabled, off by default, every route a 404 until a site sets it. grep -rn kiosk_enabled plugins/printedparts/ returns nothing. So a site that adopts the product and has no parts kiosk still serves a live unauthenticated inventory-decrement endpoint with no switch to turn it off, and the registry that is supposed to be the record of these decisions said the opposite. Whether printedparts should gain the same flag is a behaviour change for a kiosk that is in daily use here, so it is left as a decision rather than made silently; this only stops the comment misleading the next reader. Scope: product --- tests/test_core/test_authz.py | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/tests/test_core/test_authz.py b/tests/test_core/test_authz.py index ce3889dc..541b1ee3 100644 --- a/tests/test_core/test_authz.py +++ b/tests/test_core/test_authz.py @@ -51,8 +51,12 @@ EXEMPT_ENDPOINTS = {'knowledgebase.track_click', 'users.update_user', # docs/proposals/printedparts-plugin.md; justification in # the plugin README. 'printedparts.kiosk_take', - # Deliberately open kiosk writes, same bar as the parts - # kiosk: they can ONLY move a USB device between + # Deliberately open kiosk writes. NOT the same bar as the + # parts kiosk, and the difference is the point: these are + # additionally behind usb_kiosk_enabled, which the parts + # kiosk has no equivalent of, so a site that never turns + # them on serves 404s where printedparts serves a live + # write. They can ONLY move a USB device between # checked-out and checked-in, and only when a site has set # usb_kiosk_enabled (off by default - every one of these is # a 404 until then). Identity is a scanned badge resolved