From 60641161d5c384d77fe1385d1dd70aa228ee7db6 Mon Sep 17 00:00:00 2001
From: cproudlock <cproudlock@localhost>
Date: Fri, 26 Jun 2026 20:18:01 -0400
Subject: [PATCH] Second-pass review fixes: kill last hardcoded creds, wire
 get_services, dedup

Verification audit (re-run of the 6 skill lenses) confirmed the prior fixes hold
and surfaced a few misses:

Security (HIGH):
- search.py _check_smart_redirect still opened a raw pymysql connection with
  root/rootpassword (reachable on any 9-digit SSO query). Now uses the shared
  env-backed employee_connection helper.
- Deleted dead shopdb/core/services/employee_service.py (zero importers; carried
  another root/rootpassword literal). No hardcoded credentials remain in app
  logic; config.py dev defaults stay gated by ProductionConfig.validate.

Dead hook:
- get_services was implemented by the printers plugin but had no consumer (docs
  claimed otherwise). Added PluginManager.get_service(name) that resolves a
  service from enabled plugins; updated PLUGIN-HOOKS.md.

Tests:
- search disabled-plugin exclusion (the high-value gap): enabled plugin's
  hostname appears, disabled plugin's hostname drops out (searched by a hostname
  distinct from assetnumber so only the gated domain can match).
- get_service consumer test (unknown name -> None).

Simplify:
- Extract the triplicated GE_LOGO_SVG + loadLogo + drawLogoOverlay into shared
  frontend/src/views/print/qrLogo.js (renderQrDataUrl); both QR views use it.
- applications.py: lift the misplaced pagination import to the top; drop unused
  Computer unpacking in the 3 endpoints that only touch ComputerInstalledApp.

154 tests pass, naming/style green, app boots, QR render verified.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 docs/PLUGIN-HOOKS.md                         |    4 +-
 frontend/src/views/print/PrinterQRBatch.vue  |   48 +-
 frontend/src/views/print/PrinterQRSingle.vue |   46 +-
 frontend/src/views/print/qrLogo.js           |   51 +
 shopdb/core/api/applications.py              | 1031 +++++++++---------
 shopdb/core/api/search.py                    |   11 +-
 shopdb/core/services/employee_service.py     |  104 --
 shopdb/plugins/__init__.py                   |   19 +
 tests/test_core/test_search_disabled.py      |   43 +
 tests/test_plugin_contract.py                |    9 +
 10 files changed, 648 insertions(+), 718 deletions(-)
 create mode 100644 frontend/src/views/print/qrLogo.js
 delete mode 100644 shopdb/core/services/employee_service.py
 create mode 100644 tests/test_core/test_search_disabled.py

diff --git a/docs/PLUGIN-HOOKS.md b/docs/PLUGIN-HOOKS.md
index 5eb16d0..9d14be7 100644
--- a/docs/PLUGIN-HOOKS.md
+++ b/docs/PLUGIN-HOOKS.md
@@ -140,7 +140,9 @@ class ComputersPlugin(BasePlugin):
 
 ### `get_services() -> Dict[str, Type]`
 
-Returns a dict of service-name to service-class. Other plugins can request services via the plugin manager.
+Returns a dict of service-name to service-class. Another plugin obtains one via
+`plugin_manager.get_service('<name>')`, which searches enabled plugins and
+returns the registered class/factory (or None).
 
 ```python
 from .services import ZabbixService
diff --git a/frontend/src/views/print/PrinterQRBatch.vue b/frontend/src/views/print/PrinterQRBatch.vue
index 284008c..a4ac8a5 100644
--- a/frontend/src/views/print/PrinterQRBatch.vue
+++ b/frontend/src/views/print/PrinterQRBatch.vue
@@ -65,7 +65,7 @@
 <script setup>
 import { ref, computed, onMounted, watch, nextTick } from 'vue'
 import { printersApi } from '../../api'
-import QRCode from 'qrcode'
+import { renderQrDataUrl } from './qrLogo'
 
 const printers = ref([])
 const selectedPrinters = ref([])
@@ -104,22 +104,7 @@ watch(selectedPrinters, async () => {
   generateQRCodes()
 }, { deep: true })
 
-const GE_LOGO_SVG = `<svg xmlns="http://www.w3.org/2000/svg" width="32" height="32" viewBox="0 0 32.5 32"><path d="M19.8915 11.8362C19.8915 10.0196 21.1404 8.25119 21.826 8.5888C22.6014 8.97061 21.2424 10.6868 19.8915 11.8362ZM11.3823 12.4994C11.3823 11.0364 12.8475 8.25521 13.7453 8.54861C14.8023 8.89425 12.8679 11.6996 11.3823 12.4994ZM9.89679 22.9611C9.2234 22.9932 8.77447 22.5672 8.77447 21.8558C8.77447 19.9508 11.4558 18.1301 13.4841 17.1535C13.125 19.8141 12.2108 22.8525 9.90087 22.957M22.279 16.7516C20.7486 16.7516 19.5773 17.8608 19.5773 19.1912C19.5773 20.3004 20.2507 21.1846 21.1526 21.1846C21.4668 21.1846 21.7811 21.0078 21.7811 20.6099C21.7811 20.0352 21.0057 19.8945 21.0669 19.0304C21.1036 18.4637 21.6505 18.0819 22.1892 18.0819C23.2707 18.0819 23.7768 19.1148 23.7768 20.1758C23.7319 21.8156 22.5075 22.957 21.0669 22.957C19.1773 22.957 17.9611 21.1846 17.9611 19.2756C17.9611 16.4381 19.8507 15.3328 20.8424 15.0676C20.8547 15.0676 23.4299 15.5217 23.3483 14.4004C23.3156 13.9101 22.5688 13.7212 22.03 13.6971C21.4301 13.6729 20.8302 13.886 20.8302 13.886C20.5159 13.7292 20.2996 13.4238 20.165 13.0701C22.0096 11.6956 23.3156 10.3652 23.3156 8.85808C23.3156 8.0623 22.7769 7.35092 21.7403 7.35092C19.8956 7.35092 18.4998 9.65386 18.4998 11.7398C18.4998 12.0934 18.4998 12.4511 18.5896 12.7606C17.4183 13.6046 16.5491 14.1271 14.9737 15.0555C14.9737 14.8626 15.0145 14.3602 15.1492 13.7131C15.6879 13.1384 16.4307 12.2743 16.4307 11.6112C16.4307 11.3017 16.2511 11.0364 15.892 11.0364C14.9941 11.0364 14.3167 12.3667 14.1371 13.2952C13.7331 13.7815 12.9209 14.4044 12.2475 14.4044C11.7088 14.4044 11.5292 13.9141 11.4803 13.7413C13.1903 13.1625 15.3084 10.8596 15.3084 8.77769C15.3084 8.33559 15.1288 7.35895 13.778 7.35895C11.7537 7.35895 10.0437 10.3291 10.0437 12.632C9.32134 12.632 9.05607 11.8764 9.05607 11.3017C9.05607 10.727 9.28053 10.1482 9.28053 9.97136C9.28053 9.79452 9.19075 9.57347 8.92139 9.57347C8.248 9.57347 7.83989 10.4617 7.83989 11.4785C7.88478 12.8973 8.83161 13.7855 10.0886 13.8739C10.2682 14.7179 11.0354 15.5137 11.9782 15.5137C12.5659 15.5137 13.2841 15.3369 13.778 14.8947C13.7331 15.2042 13.6882 15.4695 13.6433 15.7388C11.6639 16.7596 10.2233 17.467 8.91731 18.6204C7.88478 19.5529 7.29709 20.7908 7.29709 21.7674C7.29709 23.0977 8.15005 24.3356 9.90903 24.3356C11.9782 24.3356 13.5535 22.6958 14.3208 20.4371C14.6799 19.372 14.8268 17.8247 14.9166 16.4059C16.9857 15.2565 17.9693 14.5853 19.0467 13.8337C19.1814 14.0548 19.3202 14.2316 19.4956 14.3642C18.5529 14.8505 16.3001 16.2251 16.3001 19.4604C16.3001 21.7674 17.8754 24.3356 20.9812 24.3356C23.5482 24.3356 25.3031 22.2537 25.3031 20.2602C25.3031 18.4436 24.2665 16.7596 22.2872 16.7596M30.025 20.5657C30.025 20.5657 29.9924 20.6019 29.9434 20.5818C29.9067 20.5697 29.8944 20.5496 29.8944 20.5255C29.8944 20.4974 30.4372 18.9219 30.4331 17.1133C30.429 15.164 29.621 13.9663 28.5884 13.9663C27.96 13.9663 27.5069 14.4084 27.5069 15.0756C27.5069 16.2733 28.9925 16.3617 28.9925 18.9781C28.9925 20.0432 28.768 21.06 28.4089 22.1693C26.7438 27.7076 21.4301 30.2798 16.2593 30.2798C13.8718 30.2798 12.1781 29.7975 11.6721 29.5765C11.6517 29.5684 11.6354 29.5283 11.6517 29.4881C11.6639 29.4559 11.6966 29.4358 11.717 29.4439C11.921 29.5242 13.378 29.9744 15.1778 29.9744C17.1571 29.9744 18.3284 29.1786 18.3284 28.202C18.3284 27.583 17.8346 27.0967 17.202 27.0967C15.9859 27.0967 15.8961 28.6039 13.2882 28.6039C12.1618 28.6039 11.1742 28.3828 10.0029 28.0291C4.41988 26.3451 1.76306 21.1605 1.76714 16.0161C1.76714 13.5122 2.48134 11.5187 2.49358 11.4986C2.50174 11.4866 2.53439 11.4705 2.5752 11.4866C2.61602 11.4986 2.62418 11.5348 2.62418 11.5428C2.55888 11.7518 2.08547 13.1786 2.08547 14.951C2.08547 16.9003 2.89353 18.0538 3.93015 18.0538C4.51783 18.0538 5.01165 17.6117 5.01165 16.9887C5.01165 15.791 3.52611 15.6584 3.52611 13.0862C3.52611 11.9769 3.75058 11.0043 4.10972 9.85079C5.80747 4.34464 11.0722 1.7684 16.2471 1.72821C18.6509 1.70811 20.7567 2.41949 20.8383 2.47978C20.8506 2.49184 20.8669 2.52399 20.8506 2.56016C20.8343 2.60035 20.8057 2.60839 20.7935 2.60437C20.769 2.60437 19.3977 2.03768 17.3286 2.03768C15.3941 2.03768 14.1779 2.83346 14.1779 3.85431C14.1779 4.42904 14.6268 4.91535 15.3043 4.91535C16.5205 4.91535 16.6103 3.4524 19.2181 3.4524C20.3445 3.4524 21.3322 3.67345 22.5035 4.02713C28.1314 5.71113 30.6902 10.94 30.7392 15.996C30.7637 18.5843 30.025 20.5456 30.0169 20.5576M16.2471 0.75157C7.69705 0.75157 0.763175 7.58001 0.763175 16C0.763175 24.42 7.69705 31.2444 16.2471 31.2444C24.7971 31.2444 31.7269 24.42 31.7269 16C31.7269 7.58001 24.7971 0.75157 16.2471 0.75157ZM16.2471 32C7.28893 32 0 24.8661 0 16C0 7.13389 7.28893 0 16.2471 0C25.2052 0 32.4941 7.18212 32.4941 16C32.4941 24.8179 25.2011 32 16.2471 32Z" fill="black"/></svg>`
-
-let logoImage = null
-
-function loadLogo() {
-  if (logoImage) return Promise.resolve(logoImage)
-  return new Promise(resolve => {
-    const img = new Image()
-    img.onload = () => { logoImage = img; resolve(img) }
-    img.onerror = () => resolve(null)
-    img.src = 'data:image/svg+xml;charset=utf-8,' + encodeURIComponent(GE_LOGO_SVG)
-  })
-}
-
 async function generateQRCodes() {
-  const logo = await loadLogo()
   const next = {}
   for (let pageIdx = 0; pageIdx < pages.value.length; pageIdx++) {
     const page = pages.value[pageIdx]
@@ -128,41 +113,12 @@ async function generateQRCodes() {
       if (!printer) continue
       const pos = idx + 1
       const qrUrl = `${window.location.origin}/printers/${printer.printer?.printerid || printer.assetid}`
-
-      // Render onto an offscreen canvas, composite the GE monogram, then
-      // export to a data URL. The <img> in the template prints reliably where
-      // a live <canvas> does not.
-      const canvas = document.createElement('canvas')
-      try {
-        await QRCode.toCanvas(canvas, qrUrl, { width: 144, margin: 0, errorCorrectionLevel: 'H' })
-        drawLogoOverlay(canvas, logo)
-        next[`${pageIdx}-${pos}`] = canvas.toDataURL('image/png')
-      } catch (err) {
-        console.error('QR error:', err)
-      }
+      next[`${pageIdx}-${pos}`] = await renderQrDataUrl(qrUrl)
     }
   }
   qrImages.value = next
 }
 
-function drawLogoOverlay(canvas, logo) {
-  const canvasContext = canvas.getContext('2d')
-  const size = canvas.width
-  const logoSize = Math.round(size * 0.22)
-  const x = (size - logoSize) / 2
-  const y = (size - logoSize) / 2
-
-  // White circle background
-  canvasContext.beginPath()
-  canvasContext.arc(size / 2, size / 2, logoSize / 2 + 4, 0, Math.PI * 2)
-  canvasContext.fillStyle = '#fff'
-  canvasContext.fill()
-
-  if (logo) {
-    canvasContext.drawImage(logo, 0, 0, 32.5, 32, x, y, logoSize, logoSize)
-  }
-}
-
 function displayName(printer) {
   return printer.assetnumber || printer.name || `Printer-${printer.assetid}`
 }
diff --git a/frontend/src/views/print/PrinterQRSingle.vue b/frontend/src/views/print/PrinterQRSingle.vue
index 1df65f9..cc5b128 100644
--- a/frontend/src/views/print/PrinterQRSingle.vue
+++ b/frontend/src/views/print/PrinterQRSingle.vue
@@ -47,7 +47,7 @@
 import { ref, computed, onMounted, watch, nextTick } from 'vue'
 import { useRoute } from 'vue-router'
 import { printersApi } from '../../api'
-import QRCode from 'qrcode'
+import { renderQrDataUrl } from './qrLogo'
 
 const route = useRoute()
 const loading = ref(true)
@@ -84,52 +84,10 @@ watch(position, async () => {
   generateQR()
 })
 
-const GE_LOGO_SVG = `<svg xmlns="http://www.w3.org/2000/svg" width="32" height="32" viewBox="0 0 32.5 32"><path d="M19.8915 11.8362C19.8915 10.0196 21.1404 8.25119 21.826 8.5888C22.6014 8.97061 21.2424 10.6868 19.8915 11.8362ZM11.3823 12.4994C11.3823 11.0364 12.8475 8.25521 13.7453 8.54861C14.8023 8.89425 12.8679 11.6996 11.3823 12.4994ZM9.89679 22.9611C9.2234 22.9932 8.77447 22.5672 8.77447 21.8558C8.77447 19.9508 11.4558 18.1301 13.4841 17.1535C13.125 19.8141 12.2108 22.8525 9.90087 22.957M22.279 16.7516C20.7486 16.7516 19.5773 17.8608 19.5773 19.1912C19.5773 20.3004 20.2507 21.1846 21.1526 21.1846C21.4668 21.1846 21.7811 21.0078 21.7811 20.6099C21.7811 20.0352 21.0057 19.8945 21.0669 19.0304C21.1036 18.4637 21.6505 18.0819 22.1892 18.0819C23.2707 18.0819 23.7768 19.1148 23.7768 20.1758C23.7319 21.8156 22.5075 22.957 21.0669 22.957C19.1773 22.957 17.9611 21.1846 17.9611 19.2756C17.9611 16.4381 19.8507 15.3328 20.8424 15.0676C20.8547 15.0676 23.4299 15.5217 23.3483 14.4004C23.3156 13.9101 22.5688 13.7212 22.03 13.6971C21.4301 13.6729 20.8302 13.886 20.8302 13.886C20.5159 13.7292 20.2996 13.4238 20.165 13.0701C22.0096 11.6956 23.3156 10.3652 23.3156 8.85808C23.3156 8.0623 22.7769 7.35092 21.7403 7.35092C19.8956 7.35092 18.4998 9.65386 18.4998 11.7398C18.4998 12.0934 18.4998 12.4511 18.5896 12.7606C17.4183 13.6046 16.5491 14.1271 14.9737 15.0555C14.9737 14.8626 15.0145 14.3602 15.1492 13.7131C15.6879 13.1384 16.4307 12.2743 16.4307 11.6112C16.4307 11.3017 16.2511 11.0364 15.892 11.0364C14.9941 11.0364 14.3167 12.3667 14.1371 13.2952C13.7331 13.7815 12.9209 14.4044 12.2475 14.4044C11.7088 14.4044 11.5292 13.9141 11.4803 13.7413C13.1903 13.1625 15.3084 10.8596 15.3084 8.77769C15.3084 8.33559 15.1288 7.35895 13.778 7.35895C11.7537 7.35895 10.0437 10.3291 10.0437 12.632C9.32134 12.632 9.05607 11.8764 9.05607 11.3017C9.05607 10.727 9.28053 10.1482 9.28053 9.97136C9.28053 9.79452 9.19075 9.57347 8.92139 9.57347C8.248 9.57347 7.83989 10.4617 7.83989 11.4785C7.88478 12.8973 8.83161 13.7855 10.0886 13.8739C10.2682 14.7179 11.0354 15.5137 11.9782 15.5137C12.5659 15.5137 13.2841 15.3369 13.778 14.8947C13.7331 15.2042 13.6882 15.4695 13.6433 15.7388C11.6639 16.7596 10.2233 17.467 8.91731 18.6204C7.88478 19.5529 7.29709 20.7908 7.29709 21.7674C7.29709 23.0977 8.15005 24.3356 9.90903 24.3356C11.9782 24.3356 13.5535 22.6958 14.3208 20.4371C14.6799 19.372 14.8268 17.8247 14.9166 16.4059C16.9857 15.2565 17.9693 14.5853 19.0467 13.8337C19.1814 14.0548 19.3202 14.2316 19.4956 14.3642C18.5529 14.8505 16.3001 16.2251 16.3001 19.4604C16.3001 21.7674 17.8754 24.3356 20.9812 24.3356C23.5482 24.3356 25.3031 22.2537 25.3031 20.2602C25.3031 18.4436 24.2665 16.7596 22.2872 16.7596M30.025 20.5657C30.025 20.5657 29.9924 20.6019 29.9434 20.5818C29.9067 20.5697 29.8944 20.5496 29.8944 20.5255C29.8944 20.4974 30.4372 18.9219 30.4331 17.1133C30.429 15.164 29.621 13.9663 28.5884 13.9663C27.96 13.9663 27.5069 14.4084 27.5069 15.0756C27.5069 16.2733 28.9925 16.3617 28.9925 18.9781C28.9925 20.0432 28.768 21.06 28.4089 22.1693C26.7438 27.7076 21.4301 30.2798 16.2593 30.2798C13.8718 30.2798 12.1781 29.7975 11.6721 29.5765C11.6517 29.5684 11.6354 29.5283 11.6517 29.4881C11.6639 29.4559 11.6966 29.4358 11.717 29.4439C11.921 29.5242 13.378 29.9744 15.1778 29.9744C17.1571 29.9744 18.3284 29.1786 18.3284 28.202C18.3284 27.583 17.8346 27.0967 17.202 27.0967C15.9859 27.0967 15.8961 28.6039 13.2882 28.6039C12.1618 28.6039 11.1742 28.3828 10.0029 28.0291C4.41988 26.3451 1.76306 21.1605 1.76714 16.0161C1.76714 13.5122 2.48134 11.5187 2.49358 11.4986C2.50174 11.4866 2.53439 11.4705 2.5752 11.4866C2.61602 11.4986 2.62418 11.5348 2.62418 11.5428C2.55888 11.7518 2.08547 13.1786 2.08547 14.951C2.08547 16.9003 2.89353 18.0538 3.93015 18.0538C4.51783 18.0538 5.01165 17.6117 5.01165 16.9887C5.01165 15.791 3.52611 15.6584 3.52611 13.0862C3.52611 11.9769 3.75058 11.0043 4.10972 9.85079C5.80747 4.34464 11.0722 1.7684 16.2471 1.72821C18.6509 1.70811 20.7567 2.41949 20.8383 2.47978C20.8506 2.49184 20.8669 2.52399 20.8506 2.56016C20.8343 2.60035 20.8057 2.60839 20.7935 2.60437C20.769 2.60437 19.3977 2.03768 17.3286 2.03768C15.3941 2.03768 14.1779 2.83346 14.1779 3.85431C14.1779 4.42904 14.6268 4.91535 15.3043 4.91535C16.5205 4.91535 16.6103 3.4524 19.2181 3.4524C20.3445 3.4524 21.3322 3.67345 22.5035 4.02713C28.1314 5.71113 30.6902 10.94 30.7392 15.996C30.7637 18.5843 30.025 20.5456 30.0169 20.5576M16.2471 0.75157C7.69705 0.75157 0.763175 7.58001 0.763175 16C0.763175 24.42 7.69705 31.2444 16.2471 31.2444C24.7971 31.2444 31.7269 24.42 31.7269 16C31.7269 7.58001 24.7971 0.75157 16.2471 0.75157ZM16.2471 32C7.28893 32 0 24.8661 0 16C0 7.13389 7.28893 0 16.2471 0C25.2052 0 32.4941 7.18212 32.4941 16C32.4941 24.8179 25.2011 32 16.2471 32Z" fill="black"/></svg>`
-
-let logoImage = null
-
-function loadLogo() {
-  if (logoImage) return Promise.resolve(logoImage)
-  return new Promise(resolve => {
-    const img = new Image()
-    img.onload = () => { logoImage = img; resolve(img) }
-    img.onerror = () => resolve(null)
-    img.src = 'data:image/svg+xml;charset=utf-8,' + encodeURIComponent(GE_LOGO_SVG)
-  })
-}
-
 async function generateQR() {
   if (!printer.value) return
   const qrUrl = `${window.location.origin}/printers/${printer.value.printer?.printerid || printer.value.assetid}`
-  const logo = await loadLogo()
-  // Render onto an offscreen canvas, composite the GE monogram, then export to
-  // a data URL. The <img> in the template prints where a live <canvas> does not.
-  const canvas = document.createElement('canvas')
-  try {
-    await QRCode.toCanvas(canvas, qrUrl, { width: 144, margin: 0, errorCorrectionLevel: 'H' })
-    drawLogoOverlay(canvas, logo)
-    qrImage.value = canvas.toDataURL('image/png')
-  } catch (err) {
-    console.error('QR error:', err)
-  }
-}
-
-function drawLogoOverlay(canvas, logo) {
-  const canvasContext = canvas.getContext('2d')
-  const size = canvas.width
-  const logoSize = Math.round(size * 0.22)
-  const x = (size - logoSize) / 2
-  const y = (size - logoSize) / 2
-
-  // White circle background
-  canvasContext.beginPath()
-  canvasContext.arc(size / 2, size / 2, logoSize / 2 + 4, 0, Math.PI * 2)
-  canvasContext.fillStyle = '#fff'
-  canvasContext.fill()
-
-  if (logo) {
-    canvasContext.drawImage(logo, 0, 0, 32.5, 32, x, y, logoSize, logoSize)
-  }
+  qrImage.value = await renderQrDataUrl(qrUrl)
 }
 
 function print() {
diff --git a/frontend/src/views/print/qrLogo.js b/frontend/src/views/print/qrLogo.js
new file mode 100644
index 0000000..e66a61a
--- /dev/null
+++ b/frontend/src/views/print/qrLogo.js
@@ -0,0 +1,51 @@
+// Shared GE monogram + QR-with-logo rendering for the printer QR label pages.
+// Both PrinterQRBatch and PrinterQRSingle render each QR to a data-URL image
+// (canvases print unreliably) with the GE monogram composited in the center.
+import QRCode from 'qrcode'
+
+const GE_LOGO_SVG = `<svg xmlns="http://www.w3.org/2000/svg" width="32" height="32" viewBox="0 0 32.5 32"><path d="M19.8915 11.8362C19.8915 10.0196 21.1404 8.25119 21.826 8.5888C22.6014 8.97061 21.2424 10.6868 19.8915 11.8362ZM11.3823 12.4994C11.3823 11.0364 12.8475 8.25521 13.7453 8.54861C14.8023 8.89425 12.8679 11.6996 11.3823 12.4994ZM9.89679 22.9611C9.2234 22.9932 8.77447 22.5672 8.77447 21.8558C8.77447 19.9508 11.4558 18.1301 13.4841 17.1535C13.125 19.8141 12.2108 22.8525 9.90087 22.957M22.279 16.7516C20.7486 16.7516 19.5773 17.8608 19.5773 19.1912C19.5773 20.3004 20.2507 21.1846 21.1526 21.1846C21.4668 21.1846 21.7811 21.0078 21.7811 20.6099C21.7811 20.0352 21.0057 19.8945 21.0669 19.0304C21.1036 18.4637 21.6505 18.0819 22.1892 18.0819C23.2707 18.0819 23.7768 19.1148 23.7768 20.1758C23.7319 21.8156 22.5075 22.957 21.0669 22.957C19.1773 22.957 17.9611 21.1846 17.9611 19.2756C17.9611 16.4381 19.8507 15.3328 20.8424 15.0676C20.8547 15.0676 23.4299 15.5217 23.3483 14.4004C23.3156 13.9101 22.5688 13.7212 22.03 13.6971C21.4301 13.6729 20.8302 13.886 20.8302 13.886C20.5159 13.7292 20.2996 13.4238 20.165 13.0701C22.0096 11.6956 23.3156 10.3652 23.3156 8.85808C23.3156 8.0623 22.7769 7.35092 21.7403 7.35092C19.8956 7.35092 18.4998 9.65386 18.4998 11.7398C18.4998 12.0934 18.4998 12.4511 18.5896 12.7606C17.4183 13.6046 16.5491 14.1271 14.9737 15.0555C14.9737 14.8626 15.0145 14.3602 15.1492 13.7131C15.6879 13.1384 16.4307 12.2743 16.4307 11.6112C16.4307 11.3017 16.2511 11.0364 15.892 11.0364C14.9941 11.0364 14.3167 12.3667 14.1371 13.2952C13.7331 13.7815 12.9209 14.4044 12.2475 14.4044C11.7088 14.4044 11.5292 13.9141 11.4803 13.7413C13.1903 13.1625 15.3084 10.8596 15.3084 8.77769C15.3084 8.33559 15.1288 7.35895 13.778 7.35895C11.7537 7.35895 10.0437 10.3291 10.0437 12.632C9.32134 12.632 9.05607 11.8764 9.05607 11.3017C9.05607 10.727 9.28053 10.1482 9.28053 9.97136C9.28053 9.79452 9.19075 9.57347 8.92139 9.57347C8.248 9.57347 7.83989 10.4617 7.83989 11.4785C7.88478 12.8973 8.83161 13.7855 10.0886 13.8739C10.2682 14.7179 11.0354 15.5137 11.9782 15.5137C12.5659 15.5137 13.2841 15.3369 13.778 14.8947C13.7331 15.2042 13.6882 15.4695 13.6433 15.7388C11.6639 16.7596 10.2233 17.467 8.91731 18.6204C7.88478 19.5529 7.29709 20.7908 7.29709 21.7674C7.29709 23.0977 8.15005 24.3356 9.90903 24.3356C11.9782 24.3356 13.5535 22.6958 14.3208 20.4371C14.6799 19.372 14.8268 17.8247 14.9166 16.4059C16.9857 15.2565 17.9693 14.5853 19.0467 13.8337C19.1814 14.0548 19.3202 14.2316 19.4956 14.3642C18.5529 14.8505 16.3001 16.2251 16.3001 19.4604C16.3001 21.7674 17.8754 24.3356 20.9812 24.3356C23.5482 24.3356 25.3031 22.2537 25.3031 20.2602C25.3031 18.4436 24.2665 16.7596 22.2872 16.7596M30.025 20.5657C30.025 20.5657 29.9924 20.6019 29.9434 20.5818C29.9067 20.5697 29.8944 20.5496 29.8944 20.5255C29.8944 20.4974 30.4372 18.9219 30.4331 17.1133C30.429 15.164 29.621 13.9663 28.5884 13.9663C27.96 13.9663 27.5069 14.4084 27.5069 15.0756C27.5069 16.2733 28.9925 16.3617 28.9925 18.9781C28.9925 20.0432 28.768 21.06 28.4089 22.1693C26.7438 27.7076 21.4301 30.2798 16.2593 30.2798C13.8718 30.2798 12.1781 29.7975 11.6721 29.5765C11.6517 29.5684 11.6354 29.5283 11.6517 29.4881C11.6639 29.4559 11.6966 29.4358 11.717 29.4439C11.921 29.5242 13.378 29.9744 15.1778 29.9744C17.1571 29.9744 18.3284 29.1786 18.3284 28.202C18.3284 27.583 17.8346 27.0967 17.202 27.0967C15.9859 27.0967 15.8961 28.6039 13.2882 28.6039C12.1618 28.6039 11.1742 28.3828 10.0029 28.0291C4.41988 26.3451 1.76306 21.1605 1.76714 16.0161C1.76714 13.5122 2.48134 11.5187 2.49358 11.4986C2.50174 11.4866 2.53439 11.4705 2.5752 11.4866C2.61602 11.4986 2.62418 11.5348 2.62418 11.5428C2.55888 11.7518 2.08547 13.1786 2.08547 14.951C2.08547 16.9003 2.89353 18.0538 3.93015 18.0538C4.51783 18.0538 5.01165 17.6117 5.01165 16.9887C5.01165 15.791 3.52611 15.6584 3.52611 13.0862C3.52611 11.9769 3.75058 11.0043 4.10972 9.85079C5.80747 4.34464 11.0722 1.7684 16.2471 1.72821C18.6509 1.70811 20.7567 2.41949 20.8383 2.47978C20.8506 2.49184 20.8669 2.52399 20.8506 2.56016C20.8343 2.60035 20.8057 2.60839 20.7935 2.60437C20.769 2.60437 19.3977 2.03768 17.3286 2.03768C15.3941 2.03768 14.1779 2.83346 14.1779 3.85431C14.1779 4.42904 14.6268 4.91535 15.3043 4.91535C16.5205 4.91535 16.6103 3.4524 19.2181 3.4524C20.3445 3.4524 21.3322 3.67345 22.5035 4.02713C28.1314 5.71113 30.6902 10.94 30.7392 15.996C30.7637 18.5843 30.025 20.5456 30.0169 20.5576M16.2471 0.75157C7.69705 0.75157 0.763175 7.58001 0.763175 16C0.763175 24.42 7.69705 31.2444 16.2471 31.2444C24.7971 31.2444 31.7269 24.42 31.7269 16C31.7269 7.58001 24.7971 0.75157 16.2471 0.75157ZM16.2471 32C7.28893 32 0 24.8661 0 16C0 7.13389 7.28893 0 16.2471 0C25.2052 0 32.4941 7.18212 32.4941 16C32.4941 24.8179 25.2011 32 16.2471 32Z" fill="black"/></svg>`
+
+let logoImage = null
+
+function loadLogo() {
+  if (logoImage) return Promise.resolve(logoImage)
+  return new Promise(resolve => {
+    const img = new Image()
+    img.onload = () => { logoImage = img; resolve(img) }
+    img.onerror = () => resolve(null)
+    img.src = 'data:image/svg+xml;charset=utf-8,' + encodeURIComponent(GE_LOGO_SVG)
+  })
+}
+
+function drawLogoOverlay(canvas, logo) {
+  const canvasContext = canvas.getContext('2d')
+  const size = canvas.width
+  const logoSize = Math.round(size * 0.22)
+  const x = (size - logoSize) / 2
+  const y = (size - logoSize) / 2
+
+  // White circle background behind the monogram
+  canvasContext.beginPath()
+  canvasContext.arc(size / 2, size / 2, logoSize / 2 + 4, 0, Math.PI * 2)
+  canvasContext.fillStyle = '#fff'
+  canvasContext.fill()
+
+  if (logo) {
+    canvasContext.drawImage(logo, 0, 0, 32.5, 32, x, y, logoSize, logoSize)
+  }
+}
+
+// Render a QR for `url` to a PNG data URL with the GE monogram composited in.
+// Returns the data URL string, or '' on failure.
+export async function renderQrDataUrl(url) {
+  const logo = await loadLogo()
+  const canvas = document.createElement('canvas')
+  try {
+    await QRCode.toCanvas(canvas, url, { width: 144, margin: 0, errorCorrectionLevel: 'H' })
+    drawLogoOverlay(canvas, logo)
+    return canvas.toDataURL('image/png')
+  } catch (err) {
+    console.error('QR error:', err)
+    return ''
+  }
+}
diff --git a/shopdb/core/api/applications.py b/shopdb/core/api/applications.py
index 682c2a2..5b429ac 100644
--- a/shopdb/core/api/applications.py
+++ b/shopdb/core/api/applications.py
@@ -1,515 +1,516 @@
-"""Applications API endpoints."""
-
-from flask import Blueprint, request
-from flask_jwt_extended import jwt_required
-
-from shopdb.extensions import db
-from shopdb.core.models import (
-    Application, AppVersion, AppOwner, SupportTeam, AuditLog
-)
-from shopdb.utils.responses import (
-    success_response,
-    error_response,
-    paginated_response,
-    ErrorCodes
-)
-
-
-def _computer_models():
-    """Lazily import the computers plugin models, or None if unavailable.
-
-    Application install-tracking is a join over the computers plugin's tables.
-    Importing lazily keeps the applications API importable when the computers
-    plugin is absent or disabled.
-    """
-    try:
-        from plugins.computers.models import Computer, ComputerInstalledApp
-        return Computer, ComputerInstalledApp
-    except ImportError:
-        return None
-
-
-def _installed_count(appid):
-    """Count active installs of an app, 0 when the computers plugin is absent."""
-    models = _computer_models()
-    if not models:
-        return 0
-    _, ComputerInstalledApp = models
-    return ComputerInstalledApp.query.filter_by(appid=appid, isactive=True).count()
-
-
-def _require_computer_models():
-    """Resolve (Computer, ComputerInstalledApp) or a 503 response tuple.
-
-    Usage: `models, err = _require_computer_models(); if err: return err`.
-    """
-    models = _computer_models()
-    if not models:
-        return None, error_response(
-            ErrorCodes.INTERNAL_ERROR,
-            'Install tracking requires the computers plugin',
-            http_code=503)
-    return models, None
-from shopdb.utils.pagination import get_pagination_params, paginate_query
-
-applications_bp = Blueprint('applications', __name__)
-
-
-@applications_bp.route('', methods=['GET'])
-@jwt_required(optional=True)
-def list_applications():
-    """List all applications."""
-    page, per_page = get_pagination_params(request)
-
-    query = Application.query
-
-    if request.args.get('active', 'true').lower() != 'false':
-        query = query.filter(Application.isactive == True)
-
-    # Filter out hidden unless specifically requested
-    if request.args.get('showhidden', 'false').lower() != 'true':
-        query = query.filter(Application.ishidden == False)
-
-    # Filter by installable
-    if request.args.get('installable') is not None:
-        installable = request.args.get('installable').lower() == 'true'
-        query = query.filter(Application.isinstallable == installable)
-
-    if search := request.args.get('search'):
-        query = query.filter(
-            db.or_(
-                Application.appname.ilike(f'%{search}%'),
-                Application.appdescription.ilike(f'%{search}%')
-            )
-        )
-
-    query = query.order_by(Application.appname)
-
-    items, total = paginate_query(query, page, per_page)
-    data = []
-    for app in items:
-        app_dict = app.to_dict()
-        if app.supportteam:
-            app_dict['supportteam'] = {
-                'supportteamid': app.supportteam.supportteamid,
-                'teamname': app.supportteam.teamname,
-                'teamurl': app.supportteam.teamurl,
-                'owner': {
-                    'appownerid': app.supportteam.owner.appownerid,
-                    'appowner': app.supportteam.owner.appowner,
-                    'sso': app.supportteam.owner.sso
-                } if app.supportteam.owner else None
-            }
-        else:
-            app_dict['supportteam'] = None
-        app_dict['installedcount'] = _installed_count(app.appid)
-        data.append(app_dict)
-
-    return paginated_response(data, page, per_page, total)
-
-
-@applications_bp.route('/<int:app_id>', methods=['GET'])
-@jwt_required(optional=True)
-def get_application(app_id: int):
-    """Get a single application with details."""
-    app = Application.query.get(app_id)
-
-    if not app:
-        return error_response(ErrorCodes.NOT_FOUND, 'Application not found', http_code=404)
-
-    data = app.to_dict()
-    if app.supportteam:
-        data['supportteam'] = {
-            'supportteamid': app.supportteam.supportteamid,
-            'teamname': app.supportteam.teamname,
-            'teamurl': app.supportteam.teamurl,
-            'owner': {
-                'appownerid': app.supportteam.owner.appownerid,
-                'appowner': app.supportteam.owner.appowner,
-                'sso': app.supportteam.owner.sso
-            } if app.supportteam.owner else None
-        }
-    else:
-        data['supportteam'] = None
-    data['versions'] = [v.to_dict() for v in app.versions.filter_by(isactive=True).order_by(AppVersion.version.desc()).all()]
-    data['installedcount'] = _installed_count(app.appid)
-
-    return success_response(data)
-
-
-@applications_bp.route('', methods=['POST'])
-@jwt_required()
-def create_application():
-    """Create a new application."""
-    data = request.get_json()
-
-    if not data or not data.get('appname'):
-        return error_response(ErrorCodes.VALIDATION_ERROR, 'appname is required')
-
-    if Application.query.filter_by(appname=data['appname']).first():
-        return error_response(
-            ErrorCodes.CONFLICT,
-            f"Application '{data['appname']}' already exists",
-            http_code=409
-        )
-
-    app = Application(
-        appname=data['appname'],
-        appdescription=data.get('appdescription'),
-        supportteamid=data.get('supportteamid'),
-        isinstallable=data.get('isinstallable', False),
-        applicationnotes=data.get('applicationnotes'),
-        installpath=data.get('installpath'),
-        applicationlink=data.get('applicationlink'),
-        documentationpath=data.get('documentationpath'),
-        ishidden=data.get('ishidden', False),
-        isprinter=data.get('isprinter', False),
-        islicenced=data.get('islicenced', False),
-        isrequired=data.get('isrequired', False),
-        image=data.get('image')
-    )
-
-    db.session.add(app)
-    db.session.flush()
-
-    AuditLog.log('created', 'Application', entityid=app.appid, entityname=app.appname)
-
-    db.session.commit()
-
-    return success_response(app.to_dict(), message='Application created', http_code=201)
-
-
-@applications_bp.route('/<int:app_id>', methods=['PUT'])
-@jwt_required()
-def update_application(app_id: int):
-    """Update an application."""
-    app = Application.query.get(app_id)
-
-    if not app:
-        return error_response(ErrorCodes.NOT_FOUND, 'Application not found', http_code=404)
-
-    data = request.get_json()
-    if not data:
-        return error_response(ErrorCodes.VALIDATION_ERROR, 'No data provided')
-
-    if 'appname' in data and data['appname'] != app.appname:
-        if Application.query.filter_by(appname=data['appname']).first():
-            return error_response(
-                ErrorCodes.CONFLICT,
-                f"Application '{data['appname']}' already exists",
-                http_code=409
-            )
-
-    fields = [
-        'appname', 'appdescription', 'supportteamid', 'isinstallable',
-        'applicationnotes', 'installpath', 'applicationlink', 'documentationpath',
-        'ishidden', 'isprinter', 'islicenced', 'isrequired', 'image', 'isactive'
-    ]
-
-    changes = {}
-    for key in fields:
-        if key in data:
-            old_val = getattr(app, key)
-            new_val = data[key]
-            if old_val != new_val:
-                changes[key] = {'old': old_val, 'new': new_val}
-            setattr(app, key, data[key])
-
-    if changes:
-        AuditLog.log('updated', 'Application', entityid=app.appid,
-                     entityname=app.appname, changes=changes)
-
-    db.session.commit()
-    return success_response(app.to_dict(), message='Application updated')
-
-
-@applications_bp.route('/<int:app_id>', methods=['DELETE'])
-@jwt_required()
-def delete_application(app_id: int):
-    """Delete (deactivate) an application."""
-    app = Application.query.get(app_id)
-
-    if not app:
-        return error_response(ErrorCodes.NOT_FOUND, 'Application not found', http_code=404)
-
-    app.isactive = False
-
-    AuditLog.log('deleted', 'Application', entityid=app.appid, entityname=app.appname)
-
-    db.session.commit()
-
-    return success_response(message='Application deleted')
-
-
-# ---- Versions ----
-
-@applications_bp.route('/<int:app_id>/versions', methods=['GET'])
-@jwt_required(optional=True)
-def list_versions(app_id: int):
-    """List all versions for an application."""
-    app = Application.query.get(app_id)
-    if not app:
-        return error_response(ErrorCodes.NOT_FOUND, 'Application not found', http_code=404)
-
-    versions = app.versions.filter_by(isactive=True).order_by(AppVersion.version.desc()).all()
-    return success_response([v.to_dict() for v in versions])
-
-
-@applications_bp.route('/<int:app_id>/versions', methods=['POST'])
-@jwt_required()
-def create_version(app_id: int):
-    """Create a new version for an application."""
-    app = Application.query.get(app_id)
-    if not app:
-        return error_response(ErrorCodes.NOT_FOUND, 'Application not found', http_code=404)
-
-    data = request.get_json()
-    if not data or not data.get('version'):
-        return error_response(ErrorCodes.VALIDATION_ERROR, 'version is required')
-
-    if AppVersion.query.filter_by(appid=app_id, version=data['version']).first():
-        return error_response(
-            ErrorCodes.CONFLICT,
-            f"Version '{data['version']}' already exists for this application",
-            http_code=409
-        )
-
-    version = AppVersion(
-        appid=app_id,
-        version=data['version'],
-        releasedate=data.get('releasedate'),
-        notes=data.get('notes')
-    )
-
-    db.session.add(version)
-    db.session.commit()
-
-    return success_response(version.to_dict(), message='Version created', http_code=201)
-
-
-# ---- Computers with this app installed ----
-
-@applications_bp.route('/<int:app_id>/installed', methods=['GET'])
-@jwt_required(optional=True)
-def list_installed_machines(app_id: int):
-    """List all computers that have this application installed."""
-    app = Application.query.get(app_id)
-    if not app:
-        return error_response(ErrorCodes.NOT_FOUND, 'Application not found', http_code=404)
-
-    models, err = _require_computer_models()
-    if err:
-        return err
-    Computer, ComputerInstalledApp = models
-
-    installed = ComputerInstalledApp.query.filter_by(
-        appid=app_id, isactive=True).all()
-    data = []
-    for i in installed:
-        comp = i.computer
-        version = i.installedversion
-        if not version and i.appversion:
-            version = i.appversion.version
-        item = {
-            'id': i.id,
-            'computerid': i.computerid,
-            'version': version,
-        }
-        if comp:
-            item['computer'] = {
-                'computerid': comp.computerid,
-                'assetnumber': comp.asset.assetnumber if comp.asset else None,
-                'hostname': comp.hostname,
-            }
-        data.append(item)
-
-    return success_response(data)
-
-
-# ---- Installed Apps (per computer) ----
-
-@applications_bp.route('/machines/<int:machine_id>', methods=['GET'])
-@jwt_required(optional=True)
-def list_machine_applications(machine_id: int):
-    """List all applications installed on a computer."""
-    models, err = _require_computer_models()
-    if err:
-        return err
-    Computer, ComputerInstalledApp = models
-
-    comp = Computer.query.get(machine_id)
-    if not comp:
-        return error_response(ErrorCodes.NOT_FOUND, 'Computer not found', http_code=404)
-
-    installed = comp.installedapps.filter_by(isactive=True).all()
-    return success_response([i.to_dict() for i in installed])
-
-
-@applications_bp.route('/machines/<int:machine_id>', methods=['POST'])
-@jwt_required()
-def install_application(machine_id: int):
-    """Install an application on a computer."""
-    models, err = _require_computer_models()
-    if err:
-        return err
-    Computer, ComputerInstalledApp = models
-
-    comp = Computer.query.get(machine_id)
-    if not comp:
-        return error_response(ErrorCodes.NOT_FOUND, 'Computer not found', http_code=404)
-
-    data = request.get_json()
-    if not data or not data.get('appid'):
-        return error_response(ErrorCodes.VALIDATION_ERROR, 'appid is required')
-
-    app = Application.query.get(data['appid'])
-    if not app:
-        return error_response(ErrorCodes.NOT_FOUND, 'Application not found', http_code=404)
-
-    existing = ComputerInstalledApp.query.filter_by(
-        computerid=machine_id,
-        appid=data['appid']
-    ).first()
-
-    if existing:
-        if existing.isactive:
-            return error_response(
-                ErrorCodes.CONFLICT,
-                'Application already installed on this computer',
-                http_code=409
-            )
-        existing.isactive = True
-        existing.appversionid = data.get('appversionid')
-        existing.installeddate = db.func.now()
-        db.session.commit()
-        return success_response(existing.to_dict(), message='Application reinstalled')
-
-    installed = ComputerInstalledApp(
-        computerid=machine_id,
-        appid=data['appid'],
-        appversionid=data.get('appversionid')
-    )
-
-    db.session.add(installed)
-    db.session.commit()
-
-    return success_response(installed.to_dict(), message='Application installed', http_code=201)
-
-
-@applications_bp.route('/machines/<int:machine_id>/<int:app_id>', methods=['DELETE'])
-@jwt_required()
-def uninstall_application(machine_id: int, app_id: int):
-    """Uninstall an application from a computer."""
-    models, err = _require_computer_models()
-    if err:
-        return err
-    Computer, ComputerInstalledApp = models
-
-    installed = ComputerInstalledApp.query.filter_by(
-        computerid=machine_id,
-        appid=app_id,
-        isactive=True
-    ).first()
-
-    if not installed:
-        return error_response(ErrorCodes.NOT_FOUND, 'Application not installed on this computer', http_code=404)
-
-    installed.isactive = False
-    db.session.commit()
-
-    return success_response(message='Application uninstalled')
-
-
-@applications_bp.route('/machines/<int:machine_id>/<int:app_id>', methods=['PUT'])
-@jwt_required()
-def update_installed_app(machine_id: int, app_id: int):
-    """Update installed application (e.g., change version)."""
-    models, err = _require_computer_models()
-    if err:
-        return err
-    Computer, ComputerInstalledApp = models
-
-    installed = ComputerInstalledApp.query.filter_by(
-        computerid=machine_id,
-        appid=app_id,
-        isactive=True
-    ).first()
-
-    if not installed:
-        return error_response(ErrorCodes.NOT_FOUND, 'Application not installed on this computer', http_code=404)
-
-    data = request.get_json()
-    if not data:
-        return error_response(ErrorCodes.VALIDATION_ERROR, 'No data provided')
-
-    if 'appversionid' in data:
-        installed.appversionid = data['appversionid']
-
-    db.session.commit()
-
-    return success_response(installed.to_dict(), message='Installation updated')
-
-
-# ---- Support Teams ----
-
-@applications_bp.route('/supportteams', methods=['GET'])
-@jwt_required(optional=True)
-def list_support_teams():
-    """List all support teams."""
-    teams = SupportTeam.query.filter_by(isactive=True).order_by(SupportTeam.teamname).all()
-    data = []
-    for team in teams:
-        team_dict = team.to_dict()
-        team_dict['owner'] = team.owner.appowner if team.owner else None
-        data.append(team_dict)
-    return success_response(data)
-
-
-@applications_bp.route('/supportteams', methods=['POST'])
-@jwt_required()
-def create_support_team():
-    """Create a new support team."""
-    data = request.get_json()
-    if not data or not data.get('teamname'):
-        return error_response(ErrorCodes.VALIDATION_ERROR, 'teamname is required')
-
-    team = SupportTeam(
-        teamname=data['teamname'],
-        teamurl=data.get('teamurl'),
-        appownerid=data.get('appownerid')
-    )
-
-    db.session.add(team)
-    db.session.commit()
-
-    return success_response(team.to_dict(), message='Support team created', http_code=201)
-
-
-# ---- App Owners ----
-
-@applications_bp.route('/appowners', methods=['GET'])
-@jwt_required(optional=True)
-def list_app_owners():
-    """List all application owners."""
-    owners = AppOwner.query.filter_by(isactive=True).order_by(AppOwner.appowner).all()
-    return success_response([o.to_dict() for o in owners])
-
-
-@applications_bp.route('/appowners', methods=['POST'])
-@jwt_required()
-def create_app_owner():
-    """Create a new application owner."""
-    data = request.get_json()
-    if not data or not data.get('appowner'):
-        return error_response(ErrorCodes.VALIDATION_ERROR, 'appowner is required')
-
-    owner = AppOwner(
-        appowner=data['appowner'],
-        sso=data.get('sso'),
-        email=data.get('email')
-    )
-
-    db.session.add(owner)
-    db.session.commit()
-
-    return success_response(owner.to_dict(), message='App owner created', http_code=201)
+"""Applications API endpoints."""
+
+from flask import Blueprint, request
+from flask_jwt_extended import jwt_required
+
+from shopdb.extensions import db
+from shopdb.core.models import (
+    Application, AppVersion, AppOwner, SupportTeam, AuditLog
+)
+from shopdb.utils.responses import (
+    success_response,
+    error_response,
+    paginated_response,
+    ErrorCodes
+)
+from shopdb.utils.pagination import get_pagination_params, paginate_query
+
+
+def _computer_models():
+    """Lazily import the computers plugin models, or None if unavailable.
+
+    Application install-tracking is a join over the computers plugin's tables.
+    Importing lazily keeps the applications API importable when the computers
+    plugin is absent or disabled.
+    """
+    try:
+        from plugins.computers.models import Computer, ComputerInstalledApp
+        return Computer, ComputerInstalledApp
+    except ImportError:
+        return None
+
+
+def _installed_count(appid):
+    """Count active installs of an app, 0 when the computers plugin is absent."""
+    models = _computer_models()
+    if not models:
+        return 0
+    _, ComputerInstalledApp = models
+    return ComputerInstalledApp.query.filter_by(appid=appid, isactive=True).count()
+
+
+def _require_computer_models():
+    """Resolve (Computer, ComputerInstalledApp) or a 503 response tuple.
+
+    Usage: `models, err = _require_computer_models(); if err: return err`.
+    """
+    models = _computer_models()
+    if not models:
+        return None, error_response(
+            ErrorCodes.INTERNAL_ERROR,
+            'Install tracking requires the computers plugin',
+            http_code=503)
+    return models, None
+
+
+applications_bp = Blueprint('applications', __name__)
+
+
+@applications_bp.route('', methods=['GET'])
+@jwt_required(optional=True)
+def list_applications():
+    """List all applications."""
+    page, per_page = get_pagination_params(request)
+
+    query = Application.query
+
+    if request.args.get('active', 'true').lower() != 'false':
+        query = query.filter(Application.isactive == True)
+
+    # Filter out hidden unless specifically requested
+    if request.args.get('showhidden', 'false').lower() != 'true':
+        query = query.filter(Application.ishidden == False)
+
+    # Filter by installable
+    if request.args.get('installable') is not None:
+        installable = request.args.get('installable').lower() == 'true'
+        query = query.filter(Application.isinstallable == installable)
+
+    if search := request.args.get('search'):
+        query = query.filter(
+            db.or_(
+                Application.appname.ilike(f'%{search}%'),
+                Application.appdescription.ilike(f'%{search}%')
+            )
+        )
+
+    query = query.order_by(Application.appname)
+
+    items, total = paginate_query(query, page, per_page)
+    data = []
+    for app in items:
+        app_dict = app.to_dict()
+        if app.supportteam:
+            app_dict['supportteam'] = {
+                'supportteamid': app.supportteam.supportteamid,
+                'teamname': app.supportteam.teamname,
+                'teamurl': app.supportteam.teamurl,
+                'owner': {
+                    'appownerid': app.supportteam.owner.appownerid,
+                    'appowner': app.supportteam.owner.appowner,
+                    'sso': app.supportteam.owner.sso
+                } if app.supportteam.owner else None
+            }
+        else:
+            app_dict['supportteam'] = None
+        app_dict['installedcount'] = _installed_count(app.appid)
+        data.append(app_dict)
+
+    return paginated_response(data, page, per_page, total)
+
+
+@applications_bp.route('/<int:app_id>', methods=['GET'])
+@jwt_required(optional=True)
+def get_application(app_id: int):
+    """Get a single application with details."""
+    app = Application.query.get(app_id)
+
+    if not app:
+        return error_response(ErrorCodes.NOT_FOUND, 'Application not found', http_code=404)
+
+    data = app.to_dict()
+    if app.supportteam:
+        data['supportteam'] = {
+            'supportteamid': app.supportteam.supportteamid,
+            'teamname': app.supportteam.teamname,
+            'teamurl': app.supportteam.teamurl,
+            'owner': {
+                'appownerid': app.supportteam.owner.appownerid,
+                'appowner': app.supportteam.owner.appowner,
+                'sso': app.supportteam.owner.sso
+            } if app.supportteam.owner else None
+        }
+    else:
+        data['supportteam'] = None
+    data['versions'] = [v.to_dict() for v in app.versions.filter_by(isactive=True).order_by(AppVersion.version.desc()).all()]
+    data['installedcount'] = _installed_count(app.appid)
+
+    return success_response(data)
+
+
+@applications_bp.route('', methods=['POST'])
+@jwt_required()
+def create_application():
+    """Create a new application."""
+    data = request.get_json()
+
+    if not data or not data.get('appname'):
+        return error_response(ErrorCodes.VALIDATION_ERROR, 'appname is required')
+
+    if Application.query.filter_by(appname=data['appname']).first():
+        return error_response(
+            ErrorCodes.CONFLICT,
+            f"Application '{data['appname']}' already exists",
+            http_code=409
+        )
+
+    app = Application(
+        appname=data['appname'],
+        appdescription=data.get('appdescription'),
+        supportteamid=data.get('supportteamid'),
+        isinstallable=data.get('isinstallable', False),
+        applicationnotes=data.get('applicationnotes'),
+        installpath=data.get('installpath'),
+        applicationlink=data.get('applicationlink'),
+        documentationpath=data.get('documentationpath'),
+        ishidden=data.get('ishidden', False),
+        isprinter=data.get('isprinter', False),
+        islicenced=data.get('islicenced', False),
+        isrequired=data.get('isrequired', False),
+        image=data.get('image')
+    )
+
+    db.session.add(app)
+    db.session.flush()
+
+    AuditLog.log('created', 'Application', entityid=app.appid, entityname=app.appname)
+
+    db.session.commit()
+
+    return success_response(app.to_dict(), message='Application created', http_code=201)
+
+
+@applications_bp.route('/<int:app_id>', methods=['PUT'])
+@jwt_required()
+def update_application(app_id: int):
+    """Update an application."""
+    app = Application.query.get(app_id)
+
+    if not app:
+        return error_response(ErrorCodes.NOT_FOUND, 'Application not found', http_code=404)
+
+    data = request.get_json()
+    if not data:
+        return error_response(ErrorCodes.VALIDATION_ERROR, 'No data provided')
+
+    if 'appname' in data and data['appname'] != app.appname:
+        if Application.query.filter_by(appname=data['appname']).first():
+            return error_response(
+                ErrorCodes.CONFLICT,
+                f"Application '{data['appname']}' already exists",
+                http_code=409
+            )
+
+    fields = [
+        'appname', 'appdescription', 'supportteamid', 'isinstallable',
+        'applicationnotes', 'installpath', 'applicationlink', 'documentationpath',
+        'ishidden', 'isprinter', 'islicenced', 'isrequired', 'image', 'isactive'
+    ]
+
+    changes = {}
+    for key in fields:
+        if key in data:
+            old_val = getattr(app, key)
+            new_val = data[key]
+            if old_val != new_val:
+                changes[key] = {'old': old_val, 'new': new_val}
+            setattr(app, key, data[key])
+
+    if changes:
+        AuditLog.log('updated', 'Application', entityid=app.appid,
+                     entityname=app.appname, changes=changes)
+
+    db.session.commit()
+    return success_response(app.to_dict(), message='Application updated')
+
+
+@applications_bp.route('/<int:app_id>', methods=['DELETE'])
+@jwt_required()
+def delete_application(app_id: int):
+    """Delete (deactivate) an application."""
+    app = Application.query.get(app_id)
+
+    if not app:
+        return error_response(ErrorCodes.NOT_FOUND, 'Application not found', http_code=404)
+
+    app.isactive = False
+
+    AuditLog.log('deleted', 'Application', entityid=app.appid, entityname=app.appname)
+
+    db.session.commit()
+
+    return success_response(message='Application deleted')
+
+
+# ---- Versions ----
+
+@applications_bp.route('/<int:app_id>/versions', methods=['GET'])
+@jwt_required(optional=True)
+def list_versions(app_id: int):
+    """List all versions for an application."""
+    app = Application.query.get(app_id)
+    if not app:
+        return error_response(ErrorCodes.NOT_FOUND, 'Application not found', http_code=404)
+
+    versions = app.versions.filter_by(isactive=True).order_by(AppVersion.version.desc()).all()
+    return success_response([v.to_dict() for v in versions])
+
+
+@applications_bp.route('/<int:app_id>/versions', methods=['POST'])
+@jwt_required()
+def create_version(app_id: int):
+    """Create a new version for an application."""
+    app = Application.query.get(app_id)
+    if not app:
+        return error_response(ErrorCodes.NOT_FOUND, 'Application not found', http_code=404)
+
+    data = request.get_json()
+    if not data or not data.get('version'):
+        return error_response(ErrorCodes.VALIDATION_ERROR, 'version is required')
+
+    if AppVersion.query.filter_by(appid=app_id, version=data['version']).first():
+        return error_response(
+            ErrorCodes.CONFLICT,
+            f"Version '{data['version']}' already exists for this application",
+            http_code=409
+        )
+
+    version = AppVersion(
+        appid=app_id,
+        version=data['version'],
+        releasedate=data.get('releasedate'),
+        notes=data.get('notes')
+    )
+
+    db.session.add(version)
+    db.session.commit()
+
+    return success_response(version.to_dict(), message='Version created', http_code=201)
+
+
+# ---- Computers with this app installed ----
+
+@applications_bp.route('/<int:app_id>/installed', methods=['GET'])
+@jwt_required(optional=True)
+def list_installed_machines(app_id: int):
+    """List all computers that have this application installed."""
+    app = Application.query.get(app_id)
+    if not app:
+        return error_response(ErrorCodes.NOT_FOUND, 'Application not found', http_code=404)
+
+    models, err = _require_computer_models()
+    if err:
+        return err
+    _, ComputerInstalledApp = models
+
+    installed = ComputerInstalledApp.query.filter_by(
+        appid=app_id, isactive=True).all()
+    data = []
+    for i in installed:
+        comp = i.computer
+        version = i.installedversion
+        if not version and i.appversion:
+            version = i.appversion.version
+        item = {
+            'id': i.id,
+            'computerid': i.computerid,
+            'version': version,
+        }
+        if comp:
+            item['computer'] = {
+                'computerid': comp.computerid,
+                'assetnumber': comp.asset.assetnumber if comp.asset else None,
+                'hostname': comp.hostname,
+            }
+        data.append(item)
+
+    return success_response(data)
+
+
+# ---- Installed Apps (per computer) ----
+
+@applications_bp.route('/machines/<int:machine_id>', methods=['GET'])
+@jwt_required(optional=True)
+def list_machine_applications(machine_id: int):
+    """List all applications installed on a computer."""
+    models, err = _require_computer_models()
+    if err:
+        return err
+    Computer, ComputerInstalledApp = models
+
+    comp = Computer.query.get(machine_id)
+    if not comp:
+        return error_response(ErrorCodes.NOT_FOUND, 'Computer not found', http_code=404)
+
+    installed = comp.installedapps.filter_by(isactive=True).all()
+    return success_response([i.to_dict() for i in installed])
+
+
+@applications_bp.route('/machines/<int:machine_id>', methods=['POST'])
+@jwt_required()
+def install_application(machine_id: int):
+    """Install an application on a computer."""
+    models, err = _require_computer_models()
+    if err:
+        return err
+    Computer, ComputerInstalledApp = models
+
+    comp = Computer.query.get(machine_id)
+    if not comp:
+        return error_response(ErrorCodes.NOT_FOUND, 'Computer not found', http_code=404)
+
+    data = request.get_json()
+    if not data or not data.get('appid'):
+        return error_response(ErrorCodes.VALIDATION_ERROR, 'appid is required')
+
+    app = Application.query.get(data['appid'])
+    if not app:
+        return error_response(ErrorCodes.NOT_FOUND, 'Application not found', http_code=404)
+
+    existing = ComputerInstalledApp.query.filter_by(
+        computerid=machine_id,
+        appid=data['appid']
+    ).first()
+
+    if existing:
+        if existing.isactive:
+            return error_response(
+                ErrorCodes.CONFLICT,
+                'Application already installed on this computer',
+                http_code=409
+            )
+        existing.isactive = True
+        existing.appversionid = data.get('appversionid')
+        existing.installeddate = db.func.now()
+        db.session.commit()
+        return success_response(existing.to_dict(), message='Application reinstalled')
+
+    installed = ComputerInstalledApp(
+        computerid=machine_id,
+        appid=data['appid'],
+        appversionid=data.get('appversionid')
+    )
+
+    db.session.add(installed)
+    db.session.commit()
+
+    return success_response(installed.to_dict(), message='Application installed', http_code=201)
+
+
+@applications_bp.route('/machines/<int:machine_id>/<int:app_id>', methods=['DELETE'])
+@jwt_required()
+def uninstall_application(machine_id: int, app_id: int):
+    """Uninstall an application from a computer."""
+    models, err = _require_computer_models()
+    if err:
+        return err
+    _, ComputerInstalledApp = models
+
+    installed = ComputerInstalledApp.query.filter_by(
+        computerid=machine_id,
+        appid=app_id,
+        isactive=True
+    ).first()
+
+    if not installed:
+        return error_response(ErrorCodes.NOT_FOUND, 'Application not installed on this computer', http_code=404)
+
+    installed.isactive = False
+    db.session.commit()
+
+    return success_response(message='Application uninstalled')
+
+
+@applications_bp.route('/machines/<int:machine_id>/<int:app_id>', methods=['PUT'])
+@jwt_required()
+def update_installed_app(machine_id: int, app_id: int):
+    """Update installed application (e.g., change version)."""
+    models, err = _require_computer_models()
+    if err:
+        return err
+    _, ComputerInstalledApp = models
+
+    installed = ComputerInstalledApp.query.filter_by(
+        computerid=machine_id,
+        appid=app_id,
+        isactive=True
+    ).first()
+
+    if not installed:
+        return error_response(ErrorCodes.NOT_FOUND, 'Application not installed on this computer', http_code=404)
+
+    data = request.get_json()
+    if not data:
+        return error_response(ErrorCodes.VALIDATION_ERROR, 'No data provided')
+
+    if 'appversionid' in data:
+        installed.appversionid = data['appversionid']
+
+    db.session.commit()
+
+    return success_response(installed.to_dict(), message='Installation updated')
+
+
+# ---- Support Teams ----
+
+@applications_bp.route('/supportteams', methods=['GET'])
+@jwt_required(optional=True)
+def list_support_teams():
+    """List all support teams."""
+    teams = SupportTeam.query.filter_by(isactive=True).order_by(SupportTeam.teamname).all()
+    data = []
+    for team in teams:
+        team_dict = team.to_dict()
+        team_dict['owner'] = team.owner.appowner if team.owner else None
+        data.append(team_dict)
+    return success_response(data)
+
+
+@applications_bp.route('/supportteams', methods=['POST'])
+@jwt_required()
+def create_support_team():
+    """Create a new support team."""
+    data = request.get_json()
+    if not data or not data.get('teamname'):
+        return error_response(ErrorCodes.VALIDATION_ERROR, 'teamname is required')
+
+    team = SupportTeam(
+        teamname=data['teamname'],
+        teamurl=data.get('teamurl'),
+        appownerid=data.get('appownerid')
+    )
+
+    db.session.add(team)
+    db.session.commit()
+
+    return success_response(team.to_dict(), message='Support team created', http_code=201)
+
+
+# ---- App Owners ----
+
+@applications_bp.route('/appowners', methods=['GET'])
+@jwt_required(optional=True)
+def list_app_owners():
+    """List all application owners."""
+    owners = AppOwner.query.filter_by(isactive=True).order_by(AppOwner.appowner).all()
+    return success_response([o.to_dict() for o in owners])
+
+
+@applications_bp.route('/appowners', methods=['POST'])
+@jwt_required()
+def create_app_owner():
+    """Create a new application owner."""
+    data = request.get_json()
+    if not data or not data.get('appowner'):
+        return error_response(ErrorCodes.VALIDATION_ERROR, 'appowner is required')
+
+    owner = AppOwner(
+        appowner=data['appowner'],
+        sso=data.get('sso'),
+        email=data.get('email')
+    )
+
+    db.session.add(owner)
+    db.session.commit()
+
+    return success_response(owner.to_dict(), message='App owner created', http_code=201)
diff --git a/shopdb/core/api/search.py b/shopdb/core/api/search.py
index 4e8e8a4..019962f 100644
--- a/shopdb/core/api/search.py
+++ b/shopdb/core/api/search.py
@@ -522,14 +522,9 @@ def _check_smart_redirect(query, classification):
     # Exact SSO match
     if classification['is_sso']:
         try:
-            import pymysql
-            emp_conn = pymysql.connect(
-                host='localhost',
-                user='root',
-                password='rootpassword',
-                database='wjf_employees',
-                cursorclass=pymysql.cursors.DictCursor
-            )
+            # Shared env-backed connection helper; never hardcode creds.
+            from shopdb.utils.employee_db import employee_connection
+            emp_conn = employee_connection()
             with emp_conn.cursor() as cur:
                 cur.execute(
                     'SELECT SSO, First_Name, Last_Name FROM employees WHERE SSO = %s LIMIT 1',
diff --git a/shopdb/core/services/employee_service.py b/shopdb/core/services/employee_service.py
deleted file mode 100644
index 0905f9c..0000000
--- a/shopdb/core/services/employee_service.py
+++ /dev/null
@@ -1,104 +0,0 @@
-"""Employee lookup service - queries wjf_employees database."""
-
-from typing import Optional, Dict, List
-import pymysql
-from flask import current_app
-
-
-def get_employee_connection():
-    """Get connection to wjf_employees database."""
-    return pymysql.connect(
-        host='localhost',
-        user='root',
-        password='rootpassword',
-        database='wjf_employees',
-        cursorclass=pymysql.cursors.DictCursor
-    )
-
-
-def lookup_employee(sso: str) -> Optional[Dict]:
-    """
-    Look up employee by SSO.
-
-    Returns dict with: SSO, First_Name, Last_Name, full_name, Picture, etc.
-    """
-    if not sso or not sso.strip().isdigit():
-        return None
-
-    try:
-        conn = get_employee_connection()
-        with conn.cursor() as cur:
-            cur.execute(
-                'SELECT * FROM employees WHERE SSO = %s',
-                (int(sso.strip()),)
-            )
-            row = cur.fetchone()
-            if row:
-                # Add computed full_name
-                first = (row.get('First_Name') or '').strip()
-                last = (row.get('Last_Name') or '').strip()
-                row['full_name'] = f"{first} {last}".strip()
-            return row
-        conn.close()
-    except Exception as e:
-        current_app.logger.error(f"Employee lookup error: {e}")
-        return None
-
-
-def lookup_employees(sso_list: str) -> List[Dict]:
-    """
-    Look up multiple employees by comma-separated SSO list.
-
-    Returns list of employee dicts.
-    """
-    if not sso_list:
-        return []
-
-    ssos = [s.strip() for s in sso_list.split(',') if s.strip().isdigit()]
-    if not ssos:
-        return []
-
-    try:
-        conn = get_employee_connection()
-        with conn.cursor() as cur:
-            placeholders = ','.join(['%s'] * len(ssos))
-            cur.execute(
-                f'SELECT * FROM employees WHERE SSO IN ({placeholders})',
-                [int(s) for s in ssos]
-            )
-            rows = cur.fetchall()
-
-            # Add computed full_name to each
-            for row in rows:
-                first = (row.get('First_Name') or '').strip()
-                last = (row.get('Last_Name') or '').strip()
-                row['full_name'] = f"{first} {last}".strip()
-
-            return rows
-        conn.close()
-    except Exception as e:
-        current_app.logger.error(f"Employee lookup error: {e}")
-        return []
-
-
-def get_employee_names(sso_list: str) -> str:
-    """
-    Get comma-separated list of employee names from SSO list.
-
-    Input: "212574611,212637451"
-    Output: "Brandon Saltz, Jon Kolkmann"
-    """
-    employees = lookup_employees(sso_list)
-    if not employees:
-        return sso_list  # Return SSOs as fallback
-
-    return ', '.join(emp['full_name'] for emp in employees if emp.get('full_name'))
-
-
-def get_employee_picture_url(sso: str) -> Optional[str]:
-    """Get URL to employee picture if available."""
-    emp = lookup_employee(sso)
-    if emp and emp.get('Picture'):
-        # Pictures are stored relative paths like "Support/212574611.png"
-        return f"/static/employees/{emp['Picture']}"
-    return None
diff --git a/shopdb/plugins/__init__.py b/shopdb/plugins/__init__.py
index e9dee4c..615e0d9 100644
--- a/shopdb/plugins/__init__.py
+++ b/shopdb/plugins/__init__.py
@@ -317,6 +317,25 @@ class PluginManager:
         """Get all loaded plugins."""
         return self.loader.get_all_loaded()
 
+    def get_service(self, name: str):
+        """Resolve a service exposed by an enabled plugin via get_services().
+
+        Consumer for the BasePlugin.get_services hook: searches enabled plugins
+        for one that registers `name` and returns the registered value (a service
+        class or factory). Returns None if no enabled plugin provides it. This is
+        how one plugin obtains another's service (e.g. the Zabbix service).
+        """
+        for plugin_name, plugin in self.get_all_plugins().items():
+            if not self.registry.is_enabled(plugin_name):
+                continue
+            try:
+                services = plugin.get_services() or {}
+            except Exception:
+                continue
+            if name in services:
+                return services[name]
+        return None
+
 
 # Global plugin manager instance
 plugin_manager = PluginManager()
diff --git a/tests/test_core/test_search_disabled.py b/tests/test_core/test_search_disabled.py
new file mode 100644
index 0000000..fea12d9
--- /dev/null
+++ b/tests/test_core/test_search_disabled.py
@@ -0,0 +1,43 @@
+"""Global search must exclude rows from disabled plugins (search.py _require_enabled).
+
+Pins the data-exposure property: disabling a plugin removes its plugin-specific
+matches (e.g. hostname) from /api/search, mirroring the plugin being absent.
+
+Search by HOSTNAME (distinct from assetnumber) so only the gated hostname domain
+can match - the core asset-number domain is intentionally always-on.
+"""
+
+
+def _seed_computer(client, db, auth_headers, assetnumber, hostname):
+    from shopdb.core.models import AssetType
+    if not AssetType.query.filter_by(assettype='computer').first():
+        db.session.add(AssetType(assettype='computer', pluginname='computer',
+                                 tablename='computer', description='c'))
+        db.session.commit()
+    resp = client.post('/api/computers',
+                       json={'assetnumber': assetnumber, 'hostname': hostname},
+                       headers=auth_headers)
+    assert resp.status_code == 201, resp.get_json()
+
+
+def _computer_hits(client, auth_headers, term):
+    resp = client.get(f'/api/search?q={term}', headers=auth_headers)
+    assert resp.status_code == 200, resp.get_json()
+    results = resp.get_json()['data']['results']
+    return [r for r in results if r.get('type') == 'computer']
+
+
+def test_search_includes_enabled_plugin(app, client, db, auth_headers, monkeypatch):
+    """An enabled plugin's hostname matches appear in search."""
+    _seed_computer(client, db, auth_headers, 'AST-SD01', 'hostsearch01')
+    pm = app.extensions['plugin_manager']
+    monkeypatch.setattr(pm.registry, 'is_enabled', lambda name: True)
+    assert _computer_hits(client, auth_headers, 'hostsearch01')
+
+
+def test_search_excludes_disabled_plugin(app, client, db, auth_headers, monkeypatch):
+    """A disabled plugin's hostname matches drop out of search results."""
+    _seed_computer(client, db, auth_headers, 'AST-SD02', 'hostsearch02')
+    pm = app.extensions['plugin_manager']
+    monkeypatch.setattr(pm.registry, 'is_enabled', lambda name: name != 'computers')
+    assert _computer_hits(client, auth_headers, 'hostsearch02') == []
diff --git a/tests/test_plugin_contract.py b/tests/test_plugin_contract.py
index 621a9a2..41fd0c3 100644
--- a/tests/test_plugin_contract.py
+++ b/tests/test_plugin_contract.py
@@ -137,6 +137,15 @@ def test_baseplugin_has_dashboard_widgets_hook():
     assert hasattr(BasePlugin, 'get_dashboard_widgets')
 
 
+def test_get_services_hook_has_consumer(app):
+    """get_services is consumed by plugin_manager.get_service (no dead hook)."""
+    with app.app_context():
+        pm = app.extensions['plugin_manager']
+        assert hasattr(pm, 'get_service')
+        # Unknown service name resolves to None, not an error.
+        assert pm.get_service('definitely-not-a-real-service') is None
+
+
 def test_baseplugin_does_not_have_event_handlers_hook():
     """The removed get_event_handlers hook must not be on BasePlugin."""
     assert not hasattr(BasePlugin, 'get_event_handlers'), (