Match the number on the bin, and let an unset kiosk say so

The last two kiosk findings.

Keypad entry collected EVERY digit in an item's code, and the shipped prefix
contains one: '3DP0004' collapsed to 30004, so an operator typing the 4 printed
on the label was told no part matches that barcode and had to work out that the
leading 3 belonged to the prefix. The number on a label is the number at the
end, so the trailing digit run is what is compared now. An ambiguous number is
still refused rather than guessed - taking from the wrong bin is worse than
being asked to scan the label.

A parts kiosk that had never been provisioned drew its normal "Scan the barcode
on the bin" screen and answered "Not found" to every scan, which reads as "we
do not stock that part" rather than "this screen was never set up". The server
cannot say which: the routes answer a bare 404 on purpose, so a caller without
the device token does not learn the door exists, and that stays. But the BROWSER
knows whether it holds a token, and saying so discloses nothing - an
unprovisioned screen now says it is not set up and how to fix it.

For the case the client genuinely cannot distinguish - kiosk switched off versus
a part that is not stocked, both a 404 by design - three misses in a row add a
line suggesting the kiosk may have been switched off. Truthful without the
server having to leak anything.

Three tests, verified by planting the all-digits match back.

Scope: product

tests/test_plugins/test_printedparts_ledger.py

@@ -594,3 +594,61 @@ def test_a_take_that_passed_its_precheck_is_still_refused_by_the_row(
         ledger = sum(t.quantitychange for t in after.transactions)
         assert ledger == after.quantityonhand, \
             'quantityonhand and the ledger must agree'
+
+
+# --- the number on the bin is the number you type ---------------------------
+#
+# Keypad entry matched the digits ANYWHERE in the code, and the shipped prefix
+# contains one: '3DP0004' collapsed to 30004, so an operator typing the 4
+# printed on the label was told no part matches that barcode, and had to work
+# out that the leading 3 belonged to the prefix.
+
+def test_the_keypad_matches_the_number_printed_on_the_label(client, db,
+                                                            auth_headers,
+                                                            kiosk,
+                                                            directory_employee):
+    from plugins.printedparts.models import PrintedItem
+
+    created = client.post('/api/printedparts/items', headers=auth_headers,
+                          json={'itemname': 'Keypad clip'})
+    assert created.status_code == 201, created.get_json()
+    itemcode = created.get_json()['data']['itemcode']
+    assert itemcode.startswith('3DP'), itemcode
+
+    number = str(int(itemcode[3:]))
+    found = client.get('/api/printedparts/kiosk/item/%s' % number,
+                       headers=KIOSK_HEADERS)
+    assert found.status_code == 200, (number, found.get_json())
+    assert found.get_json()['data']['itemcode'] == itemcode
+
+
+def test_the_full_code_still_works(client, db, auth_headers, kiosk):
+    created = client.post('/api/printedparts/items', headers=auth_headers,
+                          json={'itemname': 'Full code clip'})
+    itemcode = created.get_json()['data']['itemcode']
+
+    found = client.get('/api/printedparts/kiosk/item/%s' % itemcode,
+                       headers=KIOSK_HEADERS)
+    assert found.status_code == 200, found.get_json()
+
+
+def test_an_ambiguous_number_is_still_refused(client, db, auth_headers, kiosk):
+    """Two items whose trailing numbers agree must not resolve to a guess -
+    taking from the wrong bin is worse than being told to scan the label."""
+    from plugins.printedparts.models import PrintedItem
+
+    first = client.post('/api/printedparts/items', headers=auth_headers,
+                        json={'itemname': 'Ambiguous one'}).get_json()['data']
+    item = db.session.get(PrintedItem, first['printeditemid'])
+    item.gagelabtag = 'WJRP%04d' % 7777
+    db.session.commit()
+
+    second = client.post('/api/printedparts/items', headers=auth_headers,
+                         json={'itemname': 'Ambiguous two'}).get_json()['data']
+    other = db.session.get(PrintedItem, second['printeditemid'])
+    other.gagelabtag = 'GAGE%04d' % 7777
+    db.session.commit()
+
+    refused = client.get('/api/printedparts/kiosk/item/7777',
+                         headers=KIOSK_HEADERS)
+    assert refused.status_code == 404, refused.get_json()