Add custom fields + warranty plugin, rework settings into two-pane shell

Feature work from the 2026-07 session:

Settings IA
- Replace the flat 27-card settings hub with a persistent two-pane shell
  (SettingsLayout.vue): grouped, searchable left rail + content pane.
- Nest all settings/* routes under the shell via router post-processing;
  shared nav catalog in settingsNav.js. Group by asset class (PCs, Printers,
  Equipment, Network) so per-type settings stop scattering.

Custom fields (core)
- customfields + customfieldvalues tables (migration 7d14), CRUD API at
  /api/customfields, per-asset value get/save.
- Settings management page + reusable CustomFieldsSection (detail) and
  CustomFieldsInputs (form) wired into all four asset types.

Warranty (new plugin)
- plugins/warranty: warranties + warrantyassets (migration 7d15), derived
  coverage status, provider abstraction (manual now; Dell/Lenovo/HP stubs).
- API CRUD + per-asset panel + report buckets; WarrantyPanel on all four
  detail pages; Warranties management page; Warranty report + Reports card.
- Seed warranty.* permissions.

Printer drivers
- printerdrivers table (migration 7d13) linked to printer models; drivers now
  surface on the matching printer's detail page.

Other
- PCDetail rebalanced (Network + Status + Warranty + custom fields on the right).
- Rename PCs list "Features" column to "Remote Access"; fix badge hover underline.
- Drop equipment islocationonly field.
- Centralize asset-type label/route maps into utils/assetTypes.js.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/conftest.py

@@ -82,3 +82,35 @@ def auth_headers(client, admin_user):
     payload = response.get_json()
     token = payload['data']['access_token']
     return {'Authorization': f'Bearer {token}'}
+
+
+@pytest.fixture
+def member_user(db):
+    """Create an authenticated user with NO roles/permissions.
+
+    Username 'testmember', password 'testpass'. Used to prove that
+    authentication alone does not grant write access (authorization gating).
+    """
+    from shopdb.core.models import User
+
+    user = User(
+        username='testmember',
+        email='member@test.local',
+        passwordhash=generate_password_hash('testpass'),
+    )
+    db.session.add(user)
+    db.session.commit()
+
+    return user
+
+
+@pytest.fixture
+def member_headers(client, member_user):
+    """Log in as member_user (no roles) and return Authorization headers."""
+    response = client.post(
+        '/api/auth/login',
+        json={'username': 'testmember', 'password': 'testpass'},
+    )
+    assert response.status_code == 200, f'Login failed: {response.get_json()}'
+    token = response.get_json()['data']['access_token']
+    return {'Authorization': f'Bearer {token}'}

tests/test_core/test_authz.py

@@ -0,0 +1,86 @@
+"""Authorization gating and login-lockout tests.
+
+Covers the security fixes:
+  - write routes require a permission/role, not just authentication
+  - the admin role bypasses permission checks
+  - repeated bad logins lock the account
+"""
+
+
+def test_member_cannot_write_settings(client, db, member_headers):
+    """An authenticated user with no roles is forbidden from editing settings."""
+    from shopdb.core.models import Setting
+
+    setting = Setting(key='zabbix_enabled', value='false', valuetype='boolean',
+                      category='integrations')
+    db.session.add(setting)
+    db.session.commit()
+
+    response = client.put('/api/settings/zabbix_enabled',
+                          json={'value': True}, headers=member_headers)
+    assert response.status_code == 403
+    assert response.get_json()['data']['error']['code'] == 'FORBIDDEN'
+
+
+def test_admin_can_write_settings(client, db, auth_headers):
+    """The admin role bypasses the permission check and may edit settings."""
+    from shopdb.core.models import Setting
+
+    setting = Setting(key='zabbix_enabled', value='false', valuetype='boolean',
+                      category='integrations')
+    db.session.add(setting)
+    db.session.commit()
+
+    response = client.put('/api/settings/zabbix_enabled',
+                          json={'value': True}, headers=auth_headers)
+    assert response.status_code == 200
+
+
+def test_member_cannot_delete_asset(client, db, member_headers):
+    """A role-less user cannot delete assets (was previously allowed)."""
+    response = client.delete('/api/assets/1', headers=member_headers)
+    # Forbidden by authz, not a 404 - the gate runs before the lookup.
+    assert response.status_code == 403
+
+
+def test_unauthenticated_write_is_rejected(client, db):
+    """No token at all still cannot reach a write route."""
+    response = client.delete('/api/assets/1')
+    assert response.status_code in (401, 422)  # missing/!invalid JWT
+
+
+def test_member_cannot_create_business_unit(client, db, member_headers):
+    """Reference-data writes are admin-only."""
+    response = client.post('/api/businessunits',
+                           json={'businessunit': 'Test BU'}, headers=member_headers)
+    assert response.status_code == 403
+
+
+def test_account_locks_after_repeated_bad_logins(client, db, admin_user):
+    """Five bad passwords lock the account; a correct password is then refused."""
+    for _ in range(5):
+        bad = client.post('/api/auth/login',
+                          json={'username': 'testadmin', 'password': 'wrong'})
+        assert bad.status_code == 401
+
+    # Account is now locked - even the correct password is refused with 403.
+    locked = client.post('/api/auth/login',
+                         json={'username': 'testadmin', 'password': 'testpass'})
+    assert locked.status_code == 403
+    assert 'locked' in locked.get_json()['data']['error']['message'].lower()
+
+
+def test_successful_login_resets_failed_counter(client, db, admin_user):
+    """A good login before the threshold clears the failure count."""
+    for _ in range(3):
+        client.post('/api/auth/login',
+                    json={'username': 'testadmin', 'password': 'wrong'})
+
+    ok = client.post('/api/auth/login',
+                     json={'username': 'testadmin', 'password': 'testpass'})
+    assert ok.status_code == 200
+
+    from shopdb.core.models import User
+    user = User.query.filter_by(username='testadmin').first()
+    assert user.failedlogins == 0
+    assert user.lockeduntil is None

tests/test_plugins/test_pc_default_printer.py

@@ -0,0 +1,69 @@
+"""Tests for the per-PC default-printer endpoint (/api/printers/pc-default).
+
+Parity with classic apipcdefaultprinter.asp: the signed printer-installer EXE
+preselects a PC's default printer by machine (asset) number. The link is a
+`defaultprinter` asset relationship (PC asset -> printer asset).
+"""
+
+import pytest
+
+from shopdb.core.models import Asset, AssetType, AssetRelationship, RelationshipType
+from plugins.printers.models import Printer
+
+
+@pytest.fixture
+def scene(db):
+    """A PC asset, a printer asset, and the defaultprinter relationship type."""
+    pc_type = AssetType(assettype='computer', pluginname='computers', tablename='computers')
+    pr_type = AssetType(assettype='printer', pluginname='printers', tablename='printers')
+    dp_type = RelationshipType(relationshiptype='defaultprinter', description='PC to default printer')
+    db.session.add_all([pc_type, pr_type, dp_type])
+    db.session.flush()
+
+    pc = Asset(assetnumber='3210', name='CSF04 PC', assettypeid=pc_type.assettypeid, isactive=True)
+    pr_asset = Asset(assetnumber='PRN-01', name='Materials HP', assettypeid=pr_type.assettypeid, isactive=True)
+    db.session.add_all([pc, pr_asset])
+    db.session.flush()
+
+    printer = Printer(assetid=pr_asset.assetid, windowsname='HP-CSF04-Materials')
+    db.session.add(printer)
+    db.session.commit()
+
+    return {'pc': pc, 'printer_asset': pr_asset, 'printer': printer, 'dp_type': dp_type}
+
+
+def _link_default(db, pc, printer_asset, dp_type):
+    db.session.add(AssetRelationship(
+        sourceassetid=pc.assetid,
+        targetassetid=printer_asset.assetid,
+        relationshiptypeid=dp_type.relationshiptypeid,
+    ))
+    db.session.commit()
+
+
+def test_returns_default_printer_for_pc(client, db, scene):
+    _link_default(db, scene['pc'], scene['printer_asset'], scene['dp_type'])
+
+    resp = client.get('/api/printers/pc-default?machine=3210')
+    assert resp.status_code == 200
+    data = resp.get_json()['data']
+    assert data['printerid'] == scene['printer'].printerid
+    assert data['windowsname'] == 'HP-CSF04-Materials'
+
+
+def test_pc_without_default_returns_empty(client, db, scene):
+    resp = client.get('/api/printers/pc-default?machine=3210')
+    assert resp.status_code == 200
+    assert resp.get_json()['data'] == {}
+
+
+def test_unknown_machine_returns_empty(client, db, scene):
+    resp = client.get('/api/printers/pc-default?machine=NOPE')
+    assert resp.status_code == 200
+    assert resp.get_json()['data'] == {}
+
+
+def test_missing_machine_param_returns_empty(client, db, scene):
+    resp = client.get('/api/printers/pc-default')
+    assert resp.status_code == 200
+    assert resp.get_json()['data'] == {}

tests/test_plugins/test_shopfloor_feed.py

@@ -0,0 +1,70 @@
+"""Tests for the shopfloor TV feed (/api/notifications/shopfloor).
+
+Recognition AND training notifications that name several comma-joined SSOs fan
+out into one card per employee; every other type stays a single card. Mirrors
+classic apishopfloor.asp, which splits both types.
+"""
+
+import pytest
+
+from plugins.notifications.models import Notification, NotificationType
+
+
+def _make_type(db, typename, typecolor):
+    t = NotificationType(typename=typename, typecolor=typecolor, isactive=True)
+    db.session.add(t)
+    db.session.commit()
+    return t
+
+
+def _make_shopfloor_note(db, ntype, employeesso, employeename):
+    n = Notification(
+        notificationtypeid=ntype.notificationtypeid,
+        notification='msg',
+        businessunitid=None,
+        isactive=True,
+        isshopfloor=True,
+        employeesso=employeesso,
+        employeename=employeename,
+    )
+    db.session.add(n)
+    db.session.commit()
+    return n
+
+
+@pytest.mark.parametrize('typecolor', ['recognition', 'training'])
+def test_multi_employee_split_into_one_card_each(client, db, typecolor):
+    """A recognition/training note with two SSOs yields two current cards."""
+    ntype = _make_type(db, typecolor.capitalize(), typecolor)
+    _make_shopfloor_note(db, ntype, '111,222', 'Alice, Bob')
+
+    resp = client.get('/api/notifications/shopfloor')
+    assert resp.status_code == 200
+    current = resp.get_json()['data']['current']
+    assert len(current) == 2
+    assert {c['employeesso'] for c in current} == {'111', '222'}
+    assert {c['employeename'] for c in current} == {'Alice', 'Bob'}
+
+
+def test_non_split_type_stays_single_card(client, db):
+    """A non recognition/training type is not fanned out, even with many SSOs."""
+    ntype = _make_type(db, 'Awareness', 'info')
+    _make_shopfloor_note(db, ntype, '111,222', 'Alice, Bob')
+
+    resp = client.get('/api/notifications/shopfloor')
+    assert resp.status_code == 200
+    current = resp.get_json()['data']['current']
+    assert len(current) == 1
+    assert current[0]['employeesso'] == '111,222'
+
+
+def test_single_employee_recognition_stays_single_card(client, db):
+    """One SSO produces one card (no spurious split on a lone employee)."""
+    ntype = _make_type(db, 'Recognition', 'recognition')
+    _make_shopfloor_note(db, ntype, '111', 'Alice')
+
+    resp = client.get('/api/notifications/shopfloor')
+    assert resp.status_code == 200
+    current = resp.get_json()['data']['current']
+    assert len(current) == 1
+    assert current[0]['employeesso'] == '111'