ge-aerospace/shopdb-flask
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Correct the claim that the two kiosks are gated to the same bar

Browse Source 
Darkwing's reconnaissance flagged POST /api/printedparts/kiosk/take as an
unauthenticated write reaching a ledger commit and an outbound mail/webhook
trigger. Analysis dropped it, correctly: it is a declared exemption with a
decision record. Nothing to fix in the code.

The comment beside it was wrong, though. It described the USB kiosk writes as
open at the "same bar as the parts kiosk" while listing a gate the parts kiosk
does not have: usb_kiosk_enabled, off by default, every route a 404 until a site
sets it. grep -rn kiosk_enabled plugins/printedparts/ returns nothing.

So a site that adopts the product and has no parts kiosk still serves a live
unauthenticated inventory-decrement endpoint with no switch to turn it off, and
the registry that is supposed to be the record of these decisions said the
opposite. Whether printedparts should gain the same flag is a behaviour change
for a kiosk that is in daily use here, so it is left as a decision rather than
made silently; this only stops the comment misleading the next reader.

Scope: product
This commit is contained in:
cproudlock
2026-09-02 13:54:06 -04:00
parent f3a291a28d
commit 30b7a5a8bf
1 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
tests/test_core/test_authz.py
View File

@@ -51,8 +51,12 @@ EXEMPT_ENDPOINTS = {'knowledgebase.track_click', 'users.update_user',
# docs/proposals/printedparts-plugin.md; justification in # docs/proposals/printedparts-plugin.md; justification in
# the plugin README. # the plugin README.
'printedparts.kiosk_take', 'printedparts.kiosk_take',
# Deliberately open kiosk writes, same bar as the parts # Deliberately open kiosk writes. NOT the same bar as the
# kiosk: they can ONLY move a USB device between # parts kiosk, and the difference is the point: these are
# additionally behind usb_kiosk_enabled, which the parts
# kiosk has no equivalent of, so a site that never turns
# them on serves 404s where printedparts serves a live
# write. They can ONLY move a USB device between
# checked-out and checked-in, and only when a site has set # checked-out and checked-in, and only when a site has set
# usb_kiosk_enabled (off by default - every one of these is # usb_kiosk_enabled (off by default - every one of these is
# a 404 until then). Identity is a scanned badge resolved # a 404 until then). Identity is a scanned badge resolved