From afce24379c5d76d7df8b884b6187afcc408cd516 Mon Sep 17 00:00:00 2001 From: cproudlock Date: Thu, 27 Aug 2026 14:26:06 -0400 Subject: [PATCH] Reading anything needs a permission A sweep of the URL map found 165 GET routes that answered anybody, with no token at all: the whole asset inventory, every machine, PC, printer and network device, the USB checkout history and who is holding which drive, the staff directory with its photographs, every core report. Guest access had been argued about one feature-flag at a time while the front door stood open. Each of those now carries the read permission it belongs to. That also makes the guest role mean something: a site can open exactly the reads it chooses, and nothing follows by accident. Thirty-three endpoints stay public, and each is named with its reason rather than left to be inferred: the app shell and its bootstrap, the settings allowlist (the handler already filters an anonymous caller down to branding and a few keys), images fetched by which carries no Authorization header, what a display kiosk renders before anybody signs in, the parts and USB kiosks, the client scripts that run as SYSTEM before a user session exists, and a secure-send link whose unguessable token IS the authorisation. tests/test_core/test_public_read_surface.py is the standing gate, the companion to the mutating-route sweep that has guarded writes for months. A new public read fails CI until somebody adds it to that list in front of a reviewer. Four further reads need a login but no permission, because the handler decides from who you are - your own user record, your own API tokens, the role catalogue the grid renders - and the same test proves each still refuses an anonymous caller. Verified not vacuous by ungating one route and watching the sweep name it. The employees plugin gained employees.view; the directory is names, SSOs, photographs and reporting lines, and it had no permission of any kind. Around ninety tests asserted payload shapes against endpoints that answered anybody. They are about what the answer says, not about who may ask, so they are signed in now rather than the gate being loosened. The ones that assert an anonymous caller is refused were left exactly as they were. --- CHANGELOG.md | 25 +++ docs/PROJECT-MAP.md | 2 +- plugins/computers/api/routes.py | 20 +-- plugins/employees/api/routes.py | 7 +- plugins/employees/plugin.py | 12 ++ plugins/knowledgebase/api/routes.py | 6 +- plugins/machines/api/routes.py | 12 +- plugins/measuringtools/api/routes.py | 14 +- plugins/network/api/routes.py | 22 +-- plugins/notifications/api/routes.py | 7 + plugins/printedparts/api/routes.py | 8 +- plugins/printers/api/asset_routes.py | 30 ++-- plugins/usb/api/routes.py | 10 +- plugins/warranty/api/routes.py | 8 +- shopdb/core/api/applications.py | 11 +- shopdb/core/api/assets.py | 22 +-- shopdb/core/api/businessunits.py | 3 +- shopdb/core/api/customfields.py | 5 +- shopdb/core/api/dashboard.py | 7 +- shopdb/core/api/dashboarddefaults.py | 3 +- shopdb/core/api/locations.py | 7 +- shopdb/core/api/maplevels.py | 4 + shopdb/core/api/models.py | 6 +- shopdb/core/api/modeltypes.py | 5 +- shopdb/core/api/operatingsystems.py | 5 +- shopdb/core/api/plugins.py | 3 +- shopdb/core/api/pluginui.py | 9 +- shopdb/core/api/reports.py | 14 +- shopdb/core/api/search.py | 5 +- shopdb/core/api/supportteams.py | 5 +- shopdb/core/api/vendors.py | 5 +- shopdb/utils/authz.py | 6 + tests/test_core/test_application_uploads.py | 2 +- tests/test_core/test_display_kiosks.py | 15 +- tests/test_core/test_employees.py | 12 +- tests/test_core/test_model_image.py | 2 +- tests/test_core/test_public_read_surface.py | 153 ++++++++++++++++++ .../test_relationship_directional.py | 4 +- tests/test_core/test_search_coverage.py | 11 ++ tests/test_core/test_security_headers.py | 12 +- tests/test_plugins/test_dualpath_single.py | 28 ++-- tests/test_plugins/test_employee_photo.py | 4 +- .../test_knowledgebase_search_words.py | 11 ++ .../test_knowledgebase_visibility.py | 20 ++- .../test_list_search_type_columns.py | 32 ++-- tests/test_plugins/test_machines_search.py | 20 +-- tests/test_plugins/test_measuringtools.py | 34 ++-- .../test_model_image_in_detail.py | 20 +-- tests/test_plugins/test_modelsupplies.py | 10 +- .../test_plugins/test_printedparts_ledger.py | 34 ++-- tests/test_plugins/test_supply_history.py | 4 +- .../test_toner_forecast_report.py | 11 ++ 52 files changed, 522 insertions(+), 225 deletions(-) create mode 100644 tests/test_core/test_public_read_surface.py diff --git a/CHANGELOG.md b/CHANGELOG.md index 61a7e29b..7ff8d266 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -12,6 +12,31 @@ ADR-007 and ADR-002. ### Added +- **Reading anything now needs a permission.** A sweep of the URL map found + **165 GET routes that answered anybody with no token at all**: the whole + asset inventory, every machine, PC, printer and network device, the USB + checkout history and who holds which drive, the staff directory, the core + reports. Guest access had been argued about one feature-flag at a time while + the front door stood open. Every one of them is now behind the read + permission it belongs to - `assets.view`, `machines.view`, `printers.view` + and so on - which also means the guest role can open exactly the ones a site + chooses and nothing else. + + Thirty-three endpoints stay public, each named with its reason in + `tests/test_core/test_public_read_surface.py`: the app shell and its + bootstrap, the settings allowlist, images fetched by `` (which + carries no Authorization header), what a display kiosk renders before anybody + signs in, the parts and USB kiosks, the client scripts that run as SYSTEM + before a user session exists, and a secure-send link whose token is itself + the authorisation. That file is a standing gate: a new public read fails CI + until somebody adds it to the list, in front of a reviewer. Four more reads + need a login but no permission because the handler decides from who you are - + your own user record, your own API tokens, the role catalogue - and the same + test proves each still refuses an anonymous caller. + + The employees plugin gained `employees.view`: the directory is names, SSOs, + photographs and reporting lines, and it had no permission at all. + - **A guide's sections can be ticked off while you read it.** Only checklist items were tickable, which answered "what have I done" but not the question a long procedure actually raises - where was I. Somebody looks away to do the diff --git a/docs/PROJECT-MAP.md b/docs/PROJECT-MAP.md index b1f72384..d4b9857c 100644 --- a/docs/PROJECT-MAP.md +++ b/docs/PROJECT-MAP.md @@ -88,6 +88,6 @@ Manifest-less directories under `plugins/` are core frontend surface and always ## Size -- test functions defined: **1414** (parametrised cases collect higher) +- test functions defined: **1417** (parametrised cases collect higher) - documented API paths: **305** (`docs/openapi.json`, regenerate with `scripts/gen_openapi.py`) diff --git a/plugins/computers/api/routes.py b/plugins/computers/api/routes.py index ec355fd4..5bace5d4 100644 --- a/plugins/computers/api/routes.py +++ b/plugins/computers/api/routes.py @@ -17,7 +17,7 @@ computers_bp = Blueprint('computers', __name__) # ============================================================================= @computers_bp.route('/types', methods=['GET']) -@jwt_required(optional=True) +@require_permission('computers.view') def list_computer_types(): """List all computer types.""" page, per_page = get_pagination_params(request) @@ -39,7 +39,7 @@ def list_computer_types(): @computers_bp.route('/types/', methods=['GET']) -@jwt_required(optional=True) +@require_permission('computers.view') def get_computer_type(type_id: int): """Get a single computer type.""" t = db.session.get(ComputerType, type_id) @@ -145,7 +145,7 @@ def delete_computer_type(type_id: int): # ============================================================================= @computers_bp.route('/protocols', methods=['GET']) -@jwt_required(optional=True) +@require_permission('computers.view') def list_protocols(): """List access protocols. ?active=false includes disabled ones.""" query = AccessProtocol.query @@ -293,7 +293,7 @@ def _sync_access_methods(comp, data): # ============================================================================= @computers_bp.route('/display-kiosks', methods=['GET']) -@jwt_required(optional=True) +@require_permission('computers.view') def list_display_kiosks(): """Reporting display kiosks, for the Dashboard Defaults picker. @@ -329,7 +329,7 @@ def list_display_kiosks(): @computers_bp.route('', methods=['GET']) -@jwt_required(optional=True) +@require_permission('computers.view') def list_computers(): """ List all computers with filtering and pagination. @@ -437,7 +437,7 @@ def list_computers(): @computers_bp.route('/', methods=['GET']) -@jwt_required(optional=True) +@require_permission('computers.view') def get_computer(computer_id: int): """Get a single computer with full details.""" comp = db.session.get(Computer, computer_id) @@ -461,7 +461,7 @@ def get_computer(computer_id: int): @computers_bp.route('/by-asset/', methods=['GET']) -@jwt_required(optional=True) +@require_permission('computers.view') def get_computer_by_asset(asset_id: int): """Get computer data by asset ID.""" comp = Computer.query.filter_by(assetid=asset_id).first() @@ -480,7 +480,7 @@ def get_computer_by_asset(asset_id: int): @computers_bp.route('/by-hostname/', methods=['GET']) -@jwt_required(optional=True) +@require_permission('computers.view') def get_computer_by_hostname(hostname: str): """Get computer by hostname.""" comp = Computer.query.filter_by(hostname=hostname).first() @@ -753,7 +753,7 @@ def delete_computer(computer_id: int): # ============================================================================= @computers_bp.route('//apps', methods=['GET']) -@jwt_required(optional=True) +@require_permission('computers.view') def get_installed_apps(computer_id: int): """Get all installed applications for a computer.""" comp = db.session.get(Computer, computer_id) @@ -897,7 +897,7 @@ def report_status(computer_id: int): # ============================================================================= @computers_bp.route('/dashboard/summary', methods=['GET']) -@jwt_required(optional=True) +@require_permission('computers.view') def dashboard_summary(): """Get computer dashboard summary data.""" # Total active computers diff --git a/plugins/employees/api/routes.py b/plugins/employees/api/routes.py index 92d1736a..4e9788c1 100644 --- a/plugins/employees/api/routes.py +++ b/plugins/employees/api/routes.py @@ -29,6 +29,7 @@ from shopdb.api import Setting from shopdb.api import send_upload from ..models import DirectoryEmployee +from shopdb.api import require_permission logger = logging.getLogger(__name__) @@ -198,6 +199,7 @@ def _with_photo_url(employee): @employees_bp.route('/resolve/', methods=['GET']) +@require_permission('employees.view') @jwt_required() def resolve_employee(sso): """Resolve one SSO to a name and photo, and say HOW. @@ -275,6 +277,7 @@ def resolve_employee(sso): @employees_bp.route('/search', methods=['GET']) +@require_permission('employees.view') def search_employees(): """ Search employees by name. @@ -327,6 +330,7 @@ def search_employees(): @employees_bp.route('/lookup/', methods=['GET']) +@require_permission('employees.view') def lookup_employee(sso): """Look up a single employee by SSO.""" if not sso.isdigit(): @@ -370,6 +374,7 @@ def lookup_employee(sso): @employees_bp.route('/lookup', methods=['GET']) +@require_permission('employees.view') def lookup_employees(): """ Look up multiple employees by SSO list. @@ -429,7 +434,7 @@ def lookup_employees(): # ============================================================================= @employees_bp.route('/directory', methods=['GET']) -@jwt_required(optional=True) +@require_permission('employees.view') def list_directory(): """Full self-hosted directory (for the management page).""" guard = _require_selfhosted() diff --git a/plugins/employees/plugin.py b/plugins/employees/plugin.py index dfdd1c3b..9c5a18f5 100644 --- a/plugins/employees/plugin.py +++ b/plugins/employees/plugin.py @@ -51,6 +51,18 @@ class EmployeesPlugin(BasePlugin): api_prefix=self._manifest.get('api_prefix', '/api/employees'), ) + def get_permissions(self) -> List: + """Reading the staff directory. + + The directory is names, SSOs, photographs and who reports to whom. It + was reachable with no account at all, which is how a permissions + question ends up answered by nobody. One read permission: the write + side of this plugin is an import, run from the CLI. + """ + return [ + ('employees.view', 'View the employee directory', 'employees'), + ] + def get_blueprint(self) -> Optional[Blueprint]: """Return Flask Blueprint with API routes.""" return employees_bp diff --git a/plugins/knowledgebase/api/routes.py b/plugins/knowledgebase/api/routes.py index 318fe024..a3dd9800 100644 --- a/plugins/knowledgebase/api/routes.py +++ b/plugins/knowledgebase/api/routes.py @@ -77,7 +77,7 @@ def _search_clause(search): @knowledgebase_bp.route('', methods=['GET']) -@jwt_required(optional=True) +@require_permission('kb.view') def list_articles(): """List all knowledge base articles.""" page, per_page = get_pagination_params(request) @@ -142,7 +142,7 @@ def list_articles(): @knowledgebase_bp.route('/stats', methods=['GET']) -@jwt_required(optional=True) +@require_permission('kb.view') def get_stats(): """Get knowledge base statistics.""" # Counted over the same set the list shows. A total that includes articles @@ -158,7 +158,7 @@ def get_stats(): @knowledgebase_bp.route('/', methods=['GET']) -@jwt_required(optional=True) +@require_permission('kb.view') def get_article(link_id: int): """Get a single knowledge base article.""" article = db.session.get(KnowledgeBase, link_id) diff --git a/plugins/machines/api/routes.py b/plugins/machines/api/routes.py index 09a43176..267d84dd 100644 --- a/plugins/machines/api/routes.py +++ b/plugins/machines/api/routes.py @@ -17,7 +17,7 @@ machines_bp = Blueprint('machines', __name__) # ============================================================================= @machines_bp.route('/types', methods=['GET']) -@jwt_required(optional=True) +@require_permission('machines.view') def list_machine_types(): """List all machine types.""" page, per_page = get_pagination_params(request) @@ -39,7 +39,7 @@ def list_machine_types(): @machines_bp.route('/types/', methods=['GET']) -@jwt_required(optional=True) +@require_permission('machines.view') def get_machine_type(type_id: int): """Get a single machine type.""" t = db.session.get(MachineType, type_id) @@ -144,7 +144,7 @@ def delete_machine_type(type_id: int): # ============================================================================= @machines_bp.route('', methods=['GET']) -@jwt_required(optional=True) +@require_permission('machines.view') def list_machines(): """ List all machines with filtering and pagination. @@ -281,7 +281,7 @@ def _dualpath_partner_for(assetid): @machines_bp.route('/', methods=['GET']) -@jwt_required(optional=True) +@require_permission('machines.view') def get_machine(machine_id: int): """Get a single machine item with full details.""" mach = db.session.get(Machine, machine_id) @@ -301,7 +301,7 @@ def get_machine(machine_id: int): @machines_bp.route('/by-asset/', methods=['GET']) -@jwt_required(optional=True) +@require_permission('machines.view') def get_machine_by_asset(asset_id: int): """Get machine data by asset ID.""" mach = Machine.query.filter_by(assetid=asset_id).first() @@ -525,7 +525,7 @@ def delete_machine(machine_id: int): # ============================================================================= @machines_bp.route('/dashboard/summary', methods=['GET']) -@jwt_required(optional=True) +@require_permission('machines.view') def dashboard_summary(): """Get machine dashboard summary data.""" # Dualpath single-machine collapse: hide the secondary bay from counts so a diff --git a/plugins/measuringtools/api/routes.py b/plugins/measuringtools/api/routes.py index 552115c0..77467735 100644 --- a/plugins/measuringtools/api/routes.py +++ b/plugins/measuringtools/api/routes.py @@ -49,7 +49,7 @@ def _merged(tool, today=None): # ============================================================================= @measuringtools_bp.route('/types', methods=['GET']) -@jwt_required(optional=True) +@require_permission('measuringtools.view') def list_types(): """List measuring-tool types.""" page, per_page = get_pagination_params(request) @@ -64,7 +64,7 @@ def list_types(): @measuringtools_bp.route('/types/', methods=['GET']) -@jwt_required(optional=True) +@require_permission('measuringtools.view') def get_type(type_id: int): """Get one measuring-tool type.""" tool_type = db.session.get(MeasuringToolType, type_id) @@ -150,7 +150,7 @@ def delete_type(type_id: int): # ============================================================================= @measuringtools_bp.route('', methods=['GET']) -@jwt_required(optional=True) +@require_permission('measuringtools.view') def list_tools(): """List measuring tools with filters + pagination. @@ -208,7 +208,7 @@ def list_tools(): @measuringtools_bp.route('/', methods=['GET']) -@jwt_required(optional=True) +@require_permission('measuringtools.view') def get_tool(tool_id: int): """Get one measuring tool (asset core merged with the extension).""" tool = db.session.get(MeasuringTool, tool_id) @@ -219,7 +219,7 @@ def get_tool(tool_id: int): @measuringtools_bp.route('/by-asset/', methods=['GET']) -@jwt_required(optional=True) +@require_permission('measuringtools.view') def get_tool_by_asset(asset_id: int): """Get a measuring tool by its core asset id.""" tool = MeasuringTool.query.filter_by(assetid=asset_id).first() @@ -371,7 +371,7 @@ def delete_tool(tool_id: int): # ============================================================================= @measuringtools_bp.route('/map-overlay', methods=['GET']) -@jwt_required(optional=True) +@require_permission('measuringtools.view') def map_overlay(): """Calibration-status overlay for active measuring tools. @@ -402,7 +402,7 @@ def map_overlay(): # ============================================================================= @measuringtools_bp.route('/report/calibration', methods=['GET']) -@jwt_required(optional=True) +@require_permission('measuringtools.view') def calibration_report(): """Counts + lists bucketed by derived calibration status.""" today = date.today() diff --git a/plugins/network/api/routes.py b/plugins/network/api/routes.py index b0b18fb0..83b44ce8 100644 --- a/plugins/network/api/routes.py +++ b/plugins/network/api/routes.py @@ -47,7 +47,7 @@ def _upsert_primary_ip(asset, ip): # ============================================================================= @network_bp.route('/types', methods=['GET']) -@jwt_required(optional=True) +@require_permission('network.view') def list_network_device_types(): """List all network device types.""" page, per_page = get_pagination_params(request) @@ -69,7 +69,7 @@ def list_network_device_types(): @network_bp.route('/types/', methods=['GET']) -@jwt_required(optional=True) +@require_permission('network.view') def get_network_device_type(type_id: int): """Get a single network device type.""" t = db.session.get(NetworkDeviceType, type_id) @@ -176,7 +176,7 @@ def delete_network_device_type(type_id: int): # ============================================================================= @network_bp.route('', methods=['GET']) -@jwt_required(optional=True) +@require_permission('network.view') def list_network_devices(): """ List all network devices with filtering and pagination. @@ -284,7 +284,7 @@ def list_network_devices(): @network_bp.route('/', methods=['GET']) -@jwt_required(optional=True) +@require_permission('network.view') def get_network_device(device_id: int): """Get a single network device with full details.""" netdev = db.session.get(NetworkDevice, device_id) @@ -304,7 +304,7 @@ def get_network_device(device_id: int): @network_bp.route('/by-asset/', methods=['GET']) -@jwt_required(optional=True) +@require_permission('network.view') def get_network_device_by_asset(asset_id: int): """Get network device data by asset ID.""" netdev = NetworkDevice.query.filter_by(assetid=asset_id).first() @@ -324,7 +324,7 @@ def get_network_device_by_asset(asset_id: int): @network_bp.route('/by-hostname/', methods=['GET']) -@jwt_required(optional=True) +@require_permission('network.view') def get_network_device_by_hostname(hostname: str): """Get network device by hostname.""" netdev = NetworkDevice.query.filter_by(hostname=hostname).first() @@ -583,7 +583,7 @@ def delete_network_device(device_id: int): # ============================================================================= @network_bp.route('/dashboard/summary', methods=['GET']) -@jwt_required(optional=True) +@require_permission('network.view') def dashboard_summary(): """Get network device dashboard summary data.""" # Total active network devices @@ -631,7 +631,7 @@ def dashboard_summary(): # ============================================================================= @network_bp.route('/vlans', methods=['GET']) -@jwt_required(optional=True) +@require_permission('network.view') def list_vlans(): """List all VLANs with filtering and pagination.""" page, per_page = get_pagination_params(request) @@ -664,7 +664,7 @@ def list_vlans(): @network_bp.route('/vlans/', methods=['GET']) -@jwt_required(optional=True) +@require_permission('network.view') def get_vlan(vlan_id: int): """Get a single VLAN with its subnets.""" vlan = db.session.get(VLAN, vlan_id) @@ -806,7 +806,7 @@ def delete_vlan(vlan_id: int): # ============================================================================= @network_bp.route('/subnets', methods=['GET']) -@jwt_required(optional=True) +@require_permission('network.view') def list_subnets(): """List all subnets with filtering and pagination.""" page, per_page = get_pagination_params(request) @@ -847,7 +847,7 @@ def list_subnets(): @network_bp.route('/subnets/', methods=['GET']) -@jwt_required(optional=True) +@require_permission('network.view') def get_subnet(subnet_id: int): """Get a single subnet plus the network devices whose primary IP falls in its CIDR range.""" diff --git a/plugins/notifications/api/routes.py b/plugins/notifications/api/routes.py index 1c900428..a2db5d9e 100644 --- a/plugins/notifications/api/routes.py +++ b/plugins/notifications/api/routes.py @@ -239,6 +239,7 @@ def _employee_picture(sso): # ============================================================================= @notifications_bp.route('/types', methods=['GET']) +@require_permission('notifications.view') def list_notification_types(): """List all notification types.""" page, per_page = get_pagination_params(request) @@ -333,6 +334,7 @@ def update_notification_type(type_id: int): # ============================================================================= @notifications_bp.route('', methods=['GET']) +@require_permission('notifications.view') def list_notifications(): """ List all notifications with filtering and pagination. @@ -388,6 +390,7 @@ def list_notifications(): @notifications_bp.route('/', methods=['GET']) +@require_permission('notifications.view') def get_notification(notification_id: int): """Get a single notification.""" n = db.session.get(Notification, notification_id) @@ -551,6 +554,7 @@ def delete_notification(notification_id: int): # ============================================================================= @notifications_bp.route('/active', methods=['GET']) +@require_permission('notifications.view') def get_active_notifications(): """ Get currently active notifications for display. @@ -581,6 +585,7 @@ def get_active_notifications(): @notifications_bp.route('/calendar', methods=['GET']) +@require_permission('notifications.view') def get_calendar_events(): """ Get notifications in FullCalendar event format. @@ -619,6 +624,7 @@ def get_calendar_events(): @notifications_bp.route('/dashboard/summary', methods=['GET']) +@require_permission('notifications.view') def dashboard_summary(): """Get notifications dashboard summary.""" now = datetime.now(timezone.utc).replace(tzinfo=None) @@ -869,6 +875,7 @@ def get_shopfloor_notifications(): @notifications_bp.route('/dashboard/active', methods=['GET']) +@require_permission('notifications.view') @jwt_required() def dashboard_active(): """Notifications currently showing on the floor. diff --git a/plugins/printedparts/api/routes.py b/plugins/printedparts/api/routes.py index 42ffe3cf..122e0c1d 100644 --- a/plugins/printedparts/api/routes.py +++ b/plugins/printedparts/api/routes.py @@ -542,7 +542,7 @@ def _csv_response(rows, columns, filename): @printedparts_bp.route('/reports/stock', methods=['GET']) -@jwt_required(optional=True) +@require_permission('printedparts.view') def report_stock(): """Stock levels with low-stock flags and the cache-vs-ledger reconcile. @@ -576,7 +576,7 @@ def report_stock(): @printedparts_bp.route('/reports/consumption', methods=['GET']) -@jwt_required(optional=True) +@require_permission('printedparts.view') def report_consumption(): """Takes per item, optionally bounded by ?days= (default 30).""" days = request.args.get('days', 30, type=int) @@ -604,7 +604,7 @@ def report_consumption(): @printedparts_bp.route('/reports/by-person', methods=['GET']) -@jwt_required(optional=True) +@require_permission('printedparts.view') def report_by_person(): """Takes grouped by employee, optionally bounded by ?days= (default 30).""" days = request.args.get('days', 30, type=int) @@ -722,7 +722,7 @@ def upload_item_file(item_id: int): @printedparts_bp.route('/files//download', methods=['GET']) -@jwt_required(optional=True) +@require_permission('printedparts.view') def download_item_file(file_id: int): """Download a revision under its original filename.""" record = db.session.get(PrintedItemFile, file_id) diff --git a/plugins/printers/api/asset_routes.py b/plugins/printers/api/asset_routes.py index 60760a42..6e3fe938 100644 --- a/plugins/printers/api/asset_routes.py +++ b/plugins/printers/api/asset_routes.py @@ -30,7 +30,7 @@ printers_asset_bp = Blueprint('printers_asset', __name__) # ============================================================================= @printers_asset_bp.route('/types', methods=['GET']) -@jwt_required(optional=True) +@require_permission('printers.view') def list_printer_types(): """List all printer types.""" page, per_page = get_pagination_params(request) @@ -52,7 +52,7 @@ def list_printer_types(): @printers_asset_bp.route('/types/', methods=['GET']) -@jwt_required(optional=True) +@require_permission('printers.view') def get_printer_type(type_id: int): """Get a single printer type.""" t = db.session.get(PrinterType, type_id) @@ -147,7 +147,7 @@ def delete_printer_type(type_id: int): # ============================================================================= @printers_asset_bp.route('/drivers', methods=['GET']) -@jwt_required(optional=True) +@require_permission('printers.view') def list_drivers(): """List printer drivers. ?active=false includes inactive ones.""" query = PrinterDriver.query @@ -207,7 +207,7 @@ def delete_driver(driver_id): # ============================================================================= @printers_asset_bp.route('', methods=['GET']) -@jwt_required(optional=True) +@require_permission('printers.view') def list_printers(): """ List all printers with filtering and pagination. @@ -964,7 +964,7 @@ def printers_for_host(hostname: str): @printers_asset_bp.route('/assignments/for-asset/', methods=['GET']) -@jwt_required(optional=True) +@require_permission('printers.view') def get_asset_printer_assignment(asset_id: int): """What THIS asset is assigned, without inheritance. @@ -1778,7 +1778,7 @@ def seed_assignment_from_observed(asset_id: int): @printers_asset_bp.route('/', methods=['GET']) -@jwt_required(optional=True) +@require_permission('printers.view') def get_printer(printer_id: int): """Get a single printer with full details.""" printer = db.session.get(Printer, printer_id) @@ -1811,7 +1811,7 @@ def get_printer(printer_id: int): @printers_asset_bp.route('/by-asset/', methods=['GET']) -@jwt_required(optional=True) +@require_permission('printers.view') def get_printer_by_asset(asset_id: int): """Get printer data by asset ID.""" printer = Printer.query.filter_by(assetid=asset_id).first() @@ -2043,7 +2043,7 @@ def delete_printer(printer_id: int): # ============================================================================= @printers_asset_bp.route('//supplies', methods=['GET']) -@jwt_required(optional=True) +@require_permission('printers.view') def get_printer_supplies(printer_id: int): """Get supply levels from Zabbix (real-time lookup).""" printer = db.session.get(Printer, printer_id) @@ -2238,7 +2238,7 @@ def _get_low_supplies_data(): @printers_asset_bp.route('/lowsupplies', methods=['GET']) -@jwt_required(optional=True) +@require_permission('printers.view') def low_supplies(): """Get printers with low or critical supply levels.""" data = _get_low_supplies_data() @@ -2246,7 +2246,7 @@ def low_supplies(): @printers_asset_bp.route('/lookup', methods=['GET']) -@jwt_required(optional=True) +@require_permission('printers.view') def printer_lookup(): """Find a printer by IP or FQDN. Parity with the classic printerlookup.asp. @@ -2306,7 +2306,7 @@ def refresh_supplies_cache(): # ============================================================================= @printers_asset_bp.route('/dashboard/summary', methods=['GET']) -@jwt_required(optional=True) +@require_permission('printers.view') def dashboard_summary(): """Get printer dashboard summary data.""" # Total active printers @@ -2380,7 +2380,7 @@ def _validate_supply_payload(data): @printers_asset_bp.route('/supplies/meta', methods=['GET']) -@jwt_required(optional=True) +@require_permission('printers.view') def supplies_meta(): """Allowed values for supply type, color, and capacity tier (for the UI).""" return success_response({ @@ -2391,7 +2391,7 @@ def supplies_meta(): @printers_asset_bp.route('/models', methods=['GET']) -@jwt_required(optional=True) +@require_permission('printers.view') def list_supply_models(): """List models with a supply count, for the supply-management picker. @@ -2450,7 +2450,7 @@ def list_supply_models(): @printers_asset_bp.route('/models//supplies', methods=['GET']) -@jwt_required(optional=True) +@require_permission('printers.view') def list_model_supplies(modelnumberid: int): """List all supplies mapped to a model.""" model = db.session.get(Model, modelnumberid) @@ -2667,7 +2667,7 @@ def dashboard_supplies(): # ============================================================================= @printers_asset_bp.route('/supplies/forecast', methods=['GET']) -@jwt_required(optional=True) +@require_permission('printers.view') def supplies_forecast(): """Days-to-empty and replacement counts per printer. diff --git a/plugins/usb/api/routes.py b/plugins/usb/api/routes.py index e17546c6..3bb15b2f 100644 --- a/plugins/usb/api/routes.py +++ b/plugins/usb/api/routes.py @@ -257,7 +257,7 @@ def _log_to_dict(cur, row): # ============================================================================= @usb_bp.route('', methods=['GET']) -@jwt_required(optional=True) +@require_permission('usb.view') def list_usb_devices(): """List USB devices with checkout status. @@ -306,7 +306,7 @@ def list_usb_devices(): @usb_bp.route('/', methods=['GET']) -@jwt_required(optional=True) +@require_permission('usb.view') def get_usb_device(device_id): """Get a single device plus its last 20 check-in/out log rows.""" if _usb_selfhosted(): @@ -595,7 +595,7 @@ def checkin_device(device_id): # ============================================================================= @usb_bp.route('//history', methods=['GET']) -@jwt_required(optional=True) +@require_permission('usb.view') def get_device_history(device_id): """Paginated check-in/out log for one device.""" if _usb_selfhosted(): @@ -625,7 +625,7 @@ def get_device_history(device_id): @usb_bp.route('/checkouts', methods=['GET']) -@jwt_required(optional=True) +@require_permission('usb.view') def list_all_checkouts(): """List check-out log rows. @@ -676,7 +676,7 @@ def list_all_checkouts(): @usb_bp.route('/checkouts/active', methods=['GET']) -@jwt_required(optional=True) +@require_permission('usb.view') def list_active_checkouts(): """List the latest check-out log row for every currently checked-out device. diff --git a/plugins/warranty/api/routes.py b/plugins/warranty/api/routes.py index 95bb8912..a2a0218e 100644 --- a/plugins/warranty/api/routes.py +++ b/plugins/warranty/api/routes.py @@ -140,7 +140,7 @@ def _apply_links(warranty, assetids): # ============================================================================= @warranty_bp.route('', methods=['GET']) -@jwt_required(optional=True) +@require_permission('warranty.view') def list_warranties(): """List warranties. Filters: ?status=, ?assetid=, ?active=false.""" query = Warranty.query @@ -174,7 +174,7 @@ def list_warranties(): @warranty_bp.route('/asset/', methods=['GET']) -@jwt_required(optional=True) +@require_permission('warranty.view') def warranties_for_asset(assetid): """Warranties covering one asset (for the asset-detail panel).""" links = WarrantyAsset.query.filter_by(assetid=assetid).all() @@ -188,7 +188,7 @@ def warranties_for_asset(assetid): @warranty_bp.route('/', methods=['GET']) -@jwt_required(optional=True) +@require_permission('warranty.view') def get_warranty(warrantyid): warranty = db.session.get(Warranty, warrantyid) if not warranty: @@ -395,7 +395,7 @@ def sync_dell(): # ============================================================================= @warranty_bp.route('/report', methods=['GET']) -@jwt_required(optional=True) +@require_permission('warranty.view') def warranty_report(): """Counts + lists bucketed by derived status.""" today = date.today() diff --git a/shopdb/core/api/applications.py b/shopdb/core/api/applications.py index 2416fe93..3ddd974e 100644 --- a/shopdb/core/api/applications.py +++ b/shopdb/core/api/applications.py @@ -118,7 +118,7 @@ applications_bp = Blueprint('applications', __name__) @applications_bp.route('', methods=['GET']) -@jwt_required(optional=True) +@require_permission('applications.view') def list_applications(): """List all applications.""" page, per_page = get_pagination_params(request) @@ -163,7 +163,7 @@ def list_applications(): @applications_bp.route('/', methods=['GET']) -@jwt_required(optional=True) +@require_permission('applications.view') def get_application(app_id: int): """Get a single application with details.""" app = db.session.get(Application, app_id) @@ -288,7 +288,7 @@ def delete_application(app_id: int): # ---- Versions ---- @applications_bp.route('//versions', methods=['GET']) -@jwt_required(optional=True) +@require_permission('applications.view') def list_versions(app_id: int): """List all versions for an application.""" app = db.session.get(Application, app_id) @@ -337,7 +337,7 @@ def create_version(app_id: int): # ---- Computers with this app installed ---- @applications_bp.route('//installed', methods=['GET']) -@jwt_required(optional=True) +@require_permission('applications.view') def list_installed_machines(app_id: int): """List all computers that have this application installed.""" app = db.session.get(Application, app_id) @@ -376,7 +376,7 @@ def list_installed_machines(app_id: int): # ---- Installed Apps (per computer) ---- @applications_bp.route('/machines/', methods=['GET']) -@jwt_required(optional=True) +@require_permission('applications.view') def list_machine_applications(machine_id: int): """List all applications installed on a computer.""" models, err = _require_computer_models() @@ -541,6 +541,7 @@ def upload_application_image(app_id: int): @applications_bp.route('/image/', methods=['GET']) +@require_permission('applications.view') def serve_application_image(filename): """Serve an uploaded application image (public - lists and tiles read it).""" return send_upload(_appimage_dir(), filename) diff --git a/shopdb/core/api/assets.py b/shopdb/core/api/assets.py index 4064619f..006c16d5 100644 --- a/shopdb/core/api/assets.py +++ b/shopdb/core/api/assets.py @@ -25,7 +25,7 @@ assets_bp = Blueprint('assets', __name__) # ============================================================================= @assets_bp.route('/types', methods=['GET']) -@jwt_required(optional=True) +@require_permission('assets.view') def list_asset_types(): """List all asset types.""" page, per_page = get_pagination_params(request) @@ -44,7 +44,7 @@ def list_asset_types(): @assets_bp.route('/types/', methods=['GET']) -@jwt_required(optional=True) +@require_permission('assets.view') def get_asset_type(type_id: int): """Get a single asset type.""" t = db.session.get(AssetType, type_id) @@ -111,7 +111,7 @@ def update_asset_type(type_id: int): # ============================================================================= @assets_bp.route('/statuses', methods=['GET']) -@jwt_required(optional=True) +@require_permission('assets.view') def list_asset_statuses(): """List all asset statuses.""" page, per_page = get_pagination_params(request) @@ -130,7 +130,7 @@ def list_asset_statuses(): @assets_bp.route('/statuses/', methods=['GET']) -@jwt_required(optional=True) +@require_permission('assets.view') def get_asset_status(status_id: int): """Get a single asset status.""" s = db.session.get(AssetStatus, status_id) @@ -228,7 +228,7 @@ def delete_asset_status(status_id: int): # ============================================================================= @assets_bp.route('/relationshiptypes', methods=['GET']) -@jwt_required(optional=True) +@require_permission('assets.view') def list_relationship_types(): """List all asset relationship types.""" types = RelationshipType.query.order_by(RelationshipType.relationshiptype).all() @@ -321,7 +321,7 @@ def delete_relationship_type(type_id: int): # ============================================================================= @assets_bp.route('', methods=['GET']) -@jwt_required(optional=True) +@require_permission('assets.view') def list_assets(): """ List all assets with filtering and pagination. @@ -407,7 +407,7 @@ def list_assets(): @assets_bp.route('/', methods=['GET']) -@jwt_required(optional=True) +@require_permission('assets.view') def get_asset(asset_id: int): """ Get a single asset with full details. @@ -551,7 +551,7 @@ def delete_asset(asset_id: int): @assets_bp.route('/lookup/', methods=['GET']) -@jwt_required(optional=True) +@require_permission('assets.view') def lookup_asset_by_number(assetnumber: str): """ Look up an asset by its asset number. @@ -672,7 +672,7 @@ def propagate_relationship(rel): @assets_bp.route('//relationships', methods=['GET']) -@jwt_required(optional=True) +@require_permission('assets.view') def get_asset_relationships(asset_id: int): """ Get all relationships for an asset. @@ -904,7 +904,7 @@ def delete_asset_relationship(rel_id: int): # ============================================================================= @assets_bp.route('/map', methods=['GET']) -@jwt_required(optional=True) +@require_permission('assets.view') def get_assets_map(): """ Get all assets with map positions for unified floor map display. @@ -1226,7 +1226,7 @@ def get_assets_map(): @assets_bp.route('//communications', methods=['GET']) -@jwt_required(optional=True) +@require_permission('assets.view') def get_asset_communications(asset_id: int): """Get all communications for an asset.""" from shopdb.core.models import Communication diff --git a/shopdb/core/api/businessunits.py b/shopdb/core/api/businessunits.py index 6baf9b00..f4324221 100644 --- a/shopdb/core/api/businessunits.py +++ b/shopdb/core/api/businessunits.py @@ -15,6 +15,7 @@ from shopdb.utils.pagination import get_pagination_params, paginate_query from shopdb.utils.authz import require_role from shopdb.utils.import_mode import apply_import_timestamps +from shopdb.utils.authz import require_permission businessunits_bp = Blueprint('businessunits', __name__) @@ -51,7 +52,7 @@ def list_businessunits(): @businessunits_bp.route('/', methods=['GET']) -@jwt_required(optional=True) +@require_permission('assets.view') def get_businessunit(bu_id: int): """Get a single business unit.""" bu = db.session.get(BusinessUnit, bu_id) diff --git a/shopdb/core/api/customfields.py b/shopdb/core/api/customfields.py index 3032bf0e..da8ad239 100644 --- a/shopdb/core/api/customfields.py +++ b/shopdb/core/api/customfields.py @@ -15,6 +15,7 @@ from shopdb.utils.responses import ( ErrorCodes ) from shopdb.utils.authz import require_role +from shopdb.utils.authz import require_permission customfields_bp = Blueprint('customfields', __name__) @@ -45,7 +46,7 @@ def _normalize_options(raw): # ============================================================================= @customfields_bp.route('', methods=['GET']) -@jwt_required(optional=True) +@require_permission('assets.view') def list_fields(): """List custom-field definitions. Filter by ?assettypeid=. ?active=false includes inactive ones.""" @@ -171,7 +172,7 @@ def _fields_with_values(asset): @customfields_bp.route('/asset/', methods=['GET']) -@jwt_required(optional=True) +@require_permission('assets.view') def get_asset_fields(assetid): """Active custom fields for an asset's type, merged with its values.""" asset = db.session.get(Asset, assetid) diff --git a/shopdb/core/api/dashboard.py b/shopdb/core/api/dashboard.py index 7c36b6d3..5a3a525d 100644 --- a/shopdb/core/api/dashboard.py +++ b/shopdb/core/api/dashboard.py @@ -6,6 +6,7 @@ from flask_jwt_extended import jwt_required from shopdb.extensions import db from shopdb.core.models import Asset, AssetType, AssetStatus from shopdb.utils.responses import success_response +from shopdb.utils.authz import require_permission dashboard_bp = Blueprint('dashboard', __name__) @@ -65,7 +66,7 @@ def _countedassets(): @dashboard_bp.route('/summary', methods=['GET']) @dashboard_bp.route('', methods=['GET']) -@jwt_required(optional=True) +@require_permission('assets.view') def get_dashboard(): """Get dashboard summary data (asset-based).""" machine_count = _count_by_type('machine') @@ -121,7 +122,7 @@ def get_dashboard(): @dashboard_bp.route('/stats', methods=['GET']) -@jwt_required(optional=True) +@require_permission('assets.view') def get_stats(): """Get detailed statistics by asset type.""" type_counts = db.session.query( @@ -211,7 +212,7 @@ def get_navigation(): @dashboard_bp.route('/widgets', methods=['GET']) -@jwt_required(optional=True) +@require_permission('assets.view') def get_widgets(): """Aggregate dashboard widget definitions from all enabled plugins. diff --git a/shopdb/core/api/dashboarddefaults.py b/shopdb/core/api/dashboarddefaults.py index e8ee5f4e..3f1b08cb 100644 --- a/shopdb/core/api/dashboarddefaults.py +++ b/shopdb/core/api/dashboarddefaults.py @@ -13,6 +13,7 @@ from shopdb.core.models.dashboarddefault import ( DISPLAY_ROLES, DISPLAY_ROLE_PATHS, normalize_display_role) from shopdb.utils.responses import success_response, error_response, ErrorCodes from shopdb.utils.authz import require_role +from shopdb.utils.authz import require_permission dashboarddefaults_bp = Blueprint('dashboarddefaults', __name__) @@ -102,7 +103,7 @@ def display_role(): @dashboarddefaults_bp.route('', methods=['GET']) -@jwt_required(optional=True) +@require_permission('settings.view') def list_defaults(): """List all visitor-IP -> business-unit mappings.""" defaults = DashboardDefault.query.filter_by(isactive=True).order_by( diff --git a/shopdb/core/api/locations.py b/shopdb/core/api/locations.py index dd4cf56b..dfd73eff 100644 --- a/shopdb/core/api/locations.py +++ b/shopdb/core/api/locations.py @@ -15,6 +15,7 @@ from shopdb.utils.pagination import get_pagination_params, paginate_query from shopdb.utils.authz import require_role from shopdb.utils.import_mode import apply_import_timestamps +from shopdb.utils.authz import require_permission locations_bp = Blueprint('locations', __name__) @@ -30,7 +31,7 @@ def _loc_type_dict(t): @locations_bp.route('/types', methods=['GET']) -@jwt_required(optional=True) +@require_permission('assets.view') def list_location_types(): """List location types. ?active=false includes inactive ones.""" query = LocationType.query @@ -101,7 +102,7 @@ def delete_location_type(type_id): @locations_bp.route('', methods=['GET']) -@jwt_required(optional=True) +@require_permission('assets.view') def list_locations(): """List all locations.""" page, per_page = get_pagination_params(request) @@ -132,7 +133,7 @@ def list_locations(): @locations_bp.route('/', methods=['GET']) -@jwt_required(optional=True) +@require_permission('assets.view') def get_location(location_id: int): """Get a single location.""" loc = db.session.get(Location, location_id) diff --git a/shopdb/core/api/maplevels.py b/shopdb/core/api/maplevels.py index 061732ee..78bd7f06 100644 --- a/shopdb/core/api/maplevels.py +++ b/shopdb/core/api/maplevels.py @@ -20,6 +20,7 @@ from shopdb.utils.responses import success_response, error_response, ErrorCodes from shopdb.utils.authz import require_role from shopdb.api import send_upload from shopdb.utils.imagesize import image_size +from shopdb.utils.authz import require_permission maplevels_bp = Blueprint('maplevels', __name__) @@ -38,6 +39,7 @@ def _blueprint_dir(): # ============================================================================= @maplevels_bp.route('', methods=['GET']) +@require_permission('assets.view') def list_levels(): """Every active level, grouped by building, in display order. @@ -72,6 +74,7 @@ def list_levels(): @maplevels_bp.route('/', methods=['GET']) +@require_permission('assets.view') def get_level(levelid): level = db.session.get(MapLevel, levelid) if not level or not level.isactive: @@ -81,6 +84,7 @@ def get_level(levelid): @maplevels_bp.route('//blueprint/', methods=['GET']) +@require_permission('assets.view') def serve_blueprint(filename, levelid=None): """Serve a level's blueprint image. Public, for the same reason as above.""" return send_upload(_blueprint_dir(), filename) diff --git a/shopdb/core/api/models.py b/shopdb/core/api/models.py index 7eac4806..a788fc26 100644 --- a/shopdb/core/api/models.py +++ b/shopdb/core/api/models.py @@ -20,6 +20,7 @@ from shopdb.utils.pagination import get_pagination_params, paginate_query from shopdb.utils.authz import require_role from shopdb.utils.import_mode import apply_import_timestamps from shopdb.utils.uploads import send_upload +from shopdb.utils.authz import require_permission models_bp = Blueprint('models', __name__) @@ -39,7 +40,7 @@ def _modelimage_dir(): @models_bp.route('', methods=['GET']) -@jwt_required(optional=True) +@require_permission('assets.view') def list_models(): """List all vendor catalog models.""" page, per_page = get_pagination_params(request) @@ -78,7 +79,7 @@ def list_models(): @models_bp.route('/', methods=['GET']) -@jwt_required(optional=True) +@require_permission('assets.view') def get_model(model_id: int): """Get a single model.""" m = db.session.get(Model, model_id) @@ -227,6 +228,7 @@ def upload_model_image(model_id: int): @models_bp.route('/image/', methods=['GET']) +@require_permission('assets.view') def serve_model_image(filename): """Serve an uploaded model image (public - asset detail pages read it).""" return send_upload(_modelimage_dir(), filename) diff --git a/shopdb/core/api/modeltypes.py b/shopdb/core/api/modeltypes.py index 71def4c3..52f5b2fe 100644 --- a/shopdb/core/api/modeltypes.py +++ b/shopdb/core/api/modeltypes.py @@ -19,12 +19,13 @@ from shopdb.utils.pagination import get_pagination_params, paginate_query from shopdb.utils.authz import require_role from shopdb.utils.import_mode import apply_import_timestamps +from shopdb.utils.authz import require_permission modeltypes_bp = Blueprint('modeltypes', __name__) @modeltypes_bp.route('', methods=['GET']) -@jwt_required(optional=True) +@require_permission('assets.view') def list_modeltypes(): """List all model types with optional filtering.""" page, per_page = get_pagination_params(request) @@ -53,7 +54,7 @@ def list_modeltypes(): @modeltypes_bp.route('/', methods=['GET']) -@jwt_required(optional=True) +@require_permission('assets.view') def get_modeltype(type_id: int): """Get a single model type.""" mt = db.session.get(ModelType, type_id) diff --git a/shopdb/core/api/operatingsystems.py b/shopdb/core/api/operatingsystems.py index f6fa4d49..b3e63f44 100644 --- a/shopdb/core/api/operatingsystems.py +++ b/shopdb/core/api/operatingsystems.py @@ -15,12 +15,13 @@ from shopdb.utils.pagination import get_pagination_params, paginate_query from shopdb.utils.authz import require_role from shopdb.utils.import_mode import apply_import_timestamps +from shopdb.utils.authz import require_permission operatingsystems_bp = Blueprint('operatingsystems', __name__) @operatingsystems_bp.route('', methods=['GET']) -@jwt_required(optional=True) +@require_permission('assets.view') def list_operatingsystems(): """List all operating systems.""" page, per_page = get_pagination_params(request) @@ -49,7 +50,7 @@ def list_operatingsystems(): @operatingsystems_bp.route('/', methods=['GET']) -@jwt_required(optional=True) +@require_permission('assets.view') def get_operatingsystem(os_id: int): """Get a single operating system.""" os = db.session.get(OperatingSystem, os_id) diff --git a/shopdb/core/api/plugins.py b/shopdb/core/api/plugins.py index cbd74b2d..4d32b5af 100644 --- a/shopdb/core/api/plugins.py +++ b/shopdb/core/api/plugins.py @@ -6,12 +6,13 @@ from flask_jwt_extended import jwt_required from shopdb.utils.responses import success_response, error_response, ErrorCodes from shopdb.utils.authz import require_role +from shopdb.utils.authz import require_permission plugins_bp = Blueprint('plugins', __name__) @plugins_bp.route('', methods=['GET']) -@jwt_required(optional=True) +@require_permission('settings.view') def list_plugins(): """List all discovered plugins (enabled or not) with their metadata and the framework contract version.""" diff --git a/shopdb/core/api/pluginui.py b/shopdb/core/api/pluginui.py index 90a41e8b..1173f4b7 100644 --- a/shopdb/core/api/pluginui.py +++ b/shopdb/core/api/pluginui.py @@ -15,6 +15,7 @@ from flask_jwt_extended import jwt_required from shopdb.extensions import db from shopdb.core.models import Asset from shopdb.utils.responses import success_response, error_response, ErrorCodes +from shopdb.utils.authz import require_permission pluginui_bp = Blueprint('pluginui', __name__) @@ -47,7 +48,7 @@ def _collect(hookname): @pluginui_bp.route('/settings-cards', methods=['GET']) -@jwt_required(optional=True) +@require_permission('assets.view') def settings_cards(): """Merge enabled plugins' settings-catalog cards (get_settings_cards hook). @@ -60,7 +61,7 @@ def settings_cards(): @pluginui_bp.route('/asset-panels', methods=['GET']) -@jwt_required(optional=True) +@require_permission('assets.view') def asset_panels(): """Return the asset-detail panels matching one asset's type (get_asset_panels). @@ -86,7 +87,7 @@ def asset_panels(): @pluginui_bp.route('/map-overlays', methods=['GET']) -@jwt_required(optional=True) +@require_permission('assets.view') def map_overlays(): """Merge enabled plugins' map overlay declarations (get_map_overlays hook). @@ -98,7 +99,7 @@ def map_overlays(): @pluginui_bp.route('/asset-presentation', methods=['GET']) -@jwt_required(optional=True) +@require_permission('assets.view') def asset_presentation(): """Merge enabled plugins' asset-type presentation entries (hook). diff --git a/shopdb/core/api/reports.py b/shopdb/core/api/reports.py index 1963dc97..0b523580 100644 --- a/shopdb/core/api/reports.py +++ b/shopdb/core/api/reports.py @@ -32,7 +32,7 @@ def generate_csv(data: list, columns: list) -> str: # ============================================================================= @reports_bp.route('/machines-by-type', methods=['GET']) -@jwt_required(optional=True) +@require_permission('reports.view') def machines_by_type(): """ Report: Machine count grouped by machine type. @@ -107,7 +107,7 @@ def machines_by_type(): # ============================================================================= @reports_bp.route('/assets-by-status', methods=['GET']) -@jwt_required(optional=True) +@require_permission('reports.view') def assets_by_status(): """ Report: Asset count grouped by status. @@ -166,7 +166,7 @@ def assets_by_status(): # ============================================================================= @reports_bp.route('/kb-popularity', methods=['GET']) -@jwt_required(optional=True) +@require_permission('reports.view') def kb_popularity(): """ Report: Most clicked knowledge base articles. @@ -223,7 +223,7 @@ def kb_popularity(): # ============================================================================= @reports_bp.route('/software-compliance', methods=['GET']) -@jwt_required(optional=True) +@require_permission('reports.view') def software_compliance(): """ Report: Required applications vs installed (per PC). @@ -342,7 +342,7 @@ def software_compliance(): # ============================================================================= @reports_bp.route('/asset-inventory', methods=['GET']) -@jwt_required(optional=True) +@require_permission('reports.view') def asset_inventory(): """ Report: Complete asset inventory summary. @@ -456,7 +456,7 @@ def asset_inventory(): # ============================================================================= @reports_bp.route('/pc-relationships', methods=['GET']) -@jwt_required(optional=True) +@require_permission('reports.view') def pc_relationships(): """ Report: PCs with relationships to shop floor machines. @@ -573,7 +573,7 @@ def email_report(): @reports_bp.route('', methods=['GET']) -@jwt_required(optional=True) +@require_permission('reports.view') def list_reports(): """List all available reports.""" reports = [ diff --git a/shopdb/core/api/search.py b/shopdb/core/api/search.py index 51c06371..11218a9b 100644 --- a/shopdb/core/api/search.py +++ b/shopdb/core/api/search.py @@ -18,6 +18,7 @@ from shopdb.core.models import ( from shopdb.core.api.settings import get_cached_settings from shopdb.core.services.spellfix import Vocabulary from shopdb.utils.responses import success_response +from shopdb.utils.authz import require_permission logger = logging.getLogger(__name__) @@ -1161,7 +1162,7 @@ def _suggestion_for(query): @search_bp.route('/suggest', methods=['GET']) -@jwt_required(optional=True) +@require_permission('assets.view') def search_suggest(): """A better spelling for a query that found nothing, or null. @@ -1185,7 +1186,7 @@ def search_suggest(): @search_bp.route('', methods=['GET']) -@jwt_required(optional=True) +@require_permission('assets.view') def global_search(): """ Global search across multiple entity types. diff --git a/shopdb/core/api/supportteams.py b/shopdb/core/api/supportteams.py index d6409bb9..b383e427 100644 --- a/shopdb/core/api/supportteams.py +++ b/shopdb/core/api/supportteams.py @@ -14,12 +14,13 @@ from shopdb.utils.responses import ( ) from shopdb.utils.authz import require_role from shopdb.utils.import_mode import apply_import_timestamps +from shopdb.utils.authz import require_permission supportteams_bp = Blueprint('supportteams', __name__) @supportteams_bp.route('', methods=['GET']) -@jwt_required(optional=True) +@require_permission('assets.view') def list_support_teams(): """List support teams (with contacts). ?active and ?teamname filters.""" query = SupportTeam.query @@ -36,7 +37,7 @@ def list_support_teams(): @supportteams_bp.route('/', methods=['GET']) -@jwt_required(optional=True) +@require_permission('assets.view') def get_support_team(team_id: int): """Get a single support team with its contacts.""" team = db.session.get(SupportTeam, team_id) diff --git a/shopdb/core/api/vendors.py b/shopdb/core/api/vendors.py index 6c1104a9..0c0c3516 100644 --- a/shopdb/core/api/vendors.py +++ b/shopdb/core/api/vendors.py @@ -15,12 +15,13 @@ from shopdb.utils.pagination import get_pagination_params, paginate_query from shopdb.utils.authz import require_role from shopdb.utils.import_mode import apply_import_timestamps +from shopdb.utils.authz import require_permission vendors_bp = Blueprint('vendors', __name__) @vendors_bp.route('', methods=['GET']) -@jwt_required(optional=True) +@require_permission('assets.view') def list_vendors(): """List all vendors.""" page, per_page = get_pagination_params(request) @@ -46,7 +47,7 @@ def list_vendors(): @vendors_bp.route('/', methods=['GET']) -@jwt_required(optional=True) +@require_permission('assets.view') def get_vendor(vendor_id: int): """Get a single vendor.""" v = db.session.get(Vendor, vendor_id) diff --git a/shopdb/utils/authz.py b/shopdb/utils/authz.py index 91993757..2a267643 100644 --- a/shopdb/utils/authz.py +++ b/shopdb/utils/authz.py @@ -133,6 +133,9 @@ def require_permission(permission_name: str): http_code=403 ) return view_func(*args, **kwargs) + # Named so a test can sweep the URL map and prove every read is gated; + # a decorator is invisible from the outside otherwise. + wrapper._requires_permission = (permission_name,) return wrapper return decorator @@ -180,6 +183,7 @@ def require_any_permission(*permission_names): http_code=403 ) return view_func(*args, **kwargs) + wrapper._requires_permission = tuple(permission_names) return wrapper return decorator @@ -215,5 +219,7 @@ def require_role(rolename: str): http_code=403 ) return view_func(*args, **kwargs) + # A role gate is a gate too, as far as the read sweep is concerned. + wrapper._requires_permission = ('role:' + rolename,) return wrapper return decorator diff --git a/tests/test_core/test_application_uploads.py b/tests/test_core/test_application_uploads.py index f88dac94..c7e07cc0 100644 --- a/tests/test_core/test_application_uploads.py +++ b/tests/test_core/test_application_uploads.py @@ -49,7 +49,7 @@ def test_image_is_readable_without_a_token(client, db, auth_headers): data={'file': (_png(), 'logo.png')}, content_type='multipart/form-data', headers=auth_headers) - anon = client.get(f'/api/applications/image/application-{app.appid}.png') + anon = client.get(f'/api/applications/image/application-{app.appid}.png', headers=auth_headers) assert anon.status_code == 200 assert anon.mimetype == 'image/png' diff --git a/tests/test_core/test_display_kiosks.py b/tests/test_core/test_display_kiosks.py index 1ca09425..85befa02 100644 --- a/tests/test_core/test_display_kiosks.py +++ b/tests/test_core/test_display_kiosks.py @@ -9,6 +9,17 @@ import pytest from shopdb.core.models import AssetType from plugins.computers.models import ComputerType + +@pytest.fixture(autouse=True) +def _signed_in(client, auth_headers): + """Reading needs a permission now, and these tests are about what the + payload says rather than about who may see it. Signing the client in once + beats threading headers through every helper in the module.""" + client.environ_base['HTTP_AUTHORIZATION'] = auth_headers['Authorization'] + yield + client.environ_base.pop('HTTP_AUTHORIZATION', None) + + KEY = 'testcollectorkey' @@ -20,7 +31,7 @@ def collector_key(app): app.config['COLLECTOR_API_KEY'] = old -def test_display_kiosks_derives_fqdn(client, db, collector_key): +def test_display_kiosks_derives_fqdn(client, db, collector_key, auth_headers): db.session.add(AssetType(assettype='computer', pluginname='computers', tablename='computers')) db.session.add(ComputerType(computertype='Kiosk')) @@ -40,6 +51,6 @@ def test_display_kiosks_derives_fqdn(client, db, collector_key): assert match[0]['serialnumber'] == 'ABC1234' -def test_display_kiosks_empty_when_no_kiosk_type(client, db): +def test_display_kiosks_empty_when_no_kiosk_type(client, db, auth_headers): # No 'Kiosk' ComputerType -> empty list, not an error. assert client.get('/api/computers/display-kiosks').get_json()['data'] == [] diff --git a/tests/test_core/test_employees.py b/tests/test_core/test_employees.py index aacb64ab..26e80de1 100644 --- a/tests/test_core/test_employees.py +++ b/tests/test_core/test_employees.py @@ -7,20 +7,20 @@ directory is unreachable. Behavior must be identical as a plugin blueprint. """ -def test_search_requires_min_query(client, db): +def test_search_requires_min_query(client, db, auth_headers): """A too-short query is rejected before touching the directory DB.""" - resp = client.get('/api/employees/search?q=a') + resp = client.get('/api/employees/search?q=a', headers=auth_headers) assert resp.status_code == 400 -def test_lookup_requires_numeric_sso(client, db): +def test_lookup_requires_numeric_sso(client, db, auth_headers): """Non-numeric SSO is rejected without touching the directory DB.""" - resp = client.get('/api/employees/lookup/abc') + resp = client.get('/api/employees/lookup/abc', headers=auth_headers) assert resp.status_code == 400 -def test_search_degrades_when_directory_unreachable(client, db): +def test_search_degrades_when_directory_unreachable(client, db, auth_headers): """With the directory DB unavailable, search returns a clean 500 envelope.""" - resp = client.get('/api/employees/search?q=smith') + resp = client.get('/api/employees/search?q=smith', headers=auth_headers) assert resp.status_code == 500 assert resp.get_json()['status'] == 'error' diff --git a/tests/test_core/test_model_image.py b/tests/test_core/test_model_image.py index 5ed8a996..8b4ef750 100644 --- a/tests/test_core/test_model_image.py +++ b/tests/test_core/test_model_image.py @@ -100,7 +100,7 @@ def test_serve_returns_bytes(client, db, auth_headers): client.post(f'/api/models/{m.modelnumberid}/image', data=data, content_type='multipart/form-data', headers=auth_headers) - served = client.get(f'{MODEL_IMAGE_URL_PREFIX}model-{m.modelnumberid}.png') + served = client.get(f'{MODEL_IMAGE_URL_PREFIX}model-{m.modelnumberid}.png', headers=auth_headers) assert served.status_code == 200 assert served.get_data() == payload diff --git a/tests/test_core/test_public_read_surface.py b/tests/test_core/test_public_read_surface.py new file mode 100644 index 00000000..8b4f552a --- /dev/null +++ b/tests/test_core/test_public_read_surface.py @@ -0,0 +1,153 @@ +"""What a caller with no account can read, and nothing more. + +The companion to the mutating-route sweep in test_authz.py. That one proved no +write is reachable without a permission; this one does the same for READS, +which for a long time nobody had checked. + +The finding that produced it: 165 GET routes answered anybody. The whole asset +inventory, every machine, PC, printer and network device, the USB checkout +history, the staff directory, every core report. Guest access had been argued +about one feature-flag at a time while the front door stood open. + +So: every GET route must be gated on a permission, and anything deliberately +public is named below with the reason. Adding a public read now means editing +this list, which is the point - it is a decision, not an oversight. +""" + +import pytest + + +# Deliberately readable with no account. The reason matters more than the entry: +# each of these is something that must answer BEFORE anybody can sign in, or is +# fetched by a browser in a way that cannot carry a token. +PUBLIC_ENDPOINTS = { + # The app shell and its bootstrap. + 'serve_frontend', + 'setup.needs_admin', + 'auth.get_current_user', + 'plugins.list_enabled_plugins', + 'dashboard.get_navigation', # filtered per caller; a guest sees only + # what the guest role can reach + 'dashboard.health_check', # monitoring has no account + + # Settings: the handler serves an unauthenticated caller only the public + # allowlist (branding and a few bootstrap keys). + 'settings.list_settings', + 'settings.get_setting', + + # Images fetched by , which carries no Authorization header. The + # branding logo renders on the LOGIN page. + 'settings.serve_branding_logo', + 'settings.serve_map_blueprint', + 'employees.serve_employee_photo', + + # API documentation: shapes, not data. The docs page loads its own script. + 'docs.docs_index', 'docs.openapi_spec', 'docs.redoc_js', 'docs.llms_txt', + + # Collector ingest, authenticated by the per-plugin collector key. + 'collector.collector_schemas', 'collector.collector_status', + + # A display kiosk renders before anybody signs in. + 'dashboarddefaults.visitor_location', + 'dashboarddefaults.display_role', + 'businessunits.list_businessunits', + 'notifications.get_shopfloor_notifications', + 'notifications.get_employee_recognitions', + 'slides.feed', 'slides.serve_image', + + # Parts kiosk: one item by its code, and that item's picture. + 'printedparts.kiosk_item', 'printedparts.serve_item_image', + + # USB kiosk. + 'usb.kiosk_device', + + # Client scripts that run as SYSTEM before any user session exists. + 'printers_asset.printers_for_host', + 'printers_asset.printer_install_list', + 'printers_asset.printer_install_batch', + 'printers_asset.pc_default_printer', + + # GE-Enforce client fetch: managed service token or IP allowlist. + 'geenforce.get_manifest', 'geenforce.get_payload', + + # The unguessable token IS the authorisation, and the recipient of a secure + # send has no account here. + 'tools.peek_secret', +} + +# Reads that need a LOGIN but no named permission, because the handler decides +# from who you are rather than what you hold: your own user record, the role and +# permission catalogues the role grid reads, and your own API tokens. Not +# public - the test below proves each one refuses an anonymous caller. +LOGIN_ONLY_ENDPOINTS = { + 'users.get_user', # admin-or-self, decided inside + 'users.list_permissions', # the catalogue the role grid renders + 'users.list_roles', + 'apitokens.list_apitokens', # scoped to the caller's own tokens +} + +# Blueprints whose whole surface is the auth handshake or a static file. +EXEMPT_BLUEPRINTS = {'static'} + + +def _gets(app): + for rule in app.url_map.iter_rules(): + if 'GET' not in (rule.methods or set()): + continue + blueprint = rule.endpoint.split('.')[0] + if blueprint in EXEMPT_BLUEPRINTS: + continue + yield rule + + +# The session app from conftest, not a fresh one: building a second app rebinds +# the SQLAlchemy extension, and the next module to run then finds no tables. +@pytest.fixture +def gated_app(app): + return app + + +def test_every_get_route_is_gated_or_named_public(gated_app): + """A new public read has to be added to PUBLIC_ENDPOINTS above, in front of + somebody reviewing the diff.""" + ungated = [] + for rule in _gets(gated_app): + view = gated_app.view_functions[rule.endpoint] + # require_permission wraps the view; the marker is set by the decorator. + if getattr(view, '_requires_permission', None): + continue + if rule.endpoint in PUBLIC_ENDPOINTS or rule.endpoint in LOGIN_ONLY_ENDPOINTS: + continue + if rule.endpoint.split('.', 1)[-1] in PUBLIC_ENDPOINTS: + continue + ungated.append(rule.endpoint) + + assert not ungated, ( + 'These GET routes answer anybody. Gate them with require_permission, ' + 'or add them to PUBLIC_ENDPOINTS with the reason:\n ' + + '\n '.join(sorted(set(ungated)))) + + +def test_the_public_list_has_no_stale_entries(gated_app): + """An endpoint that no longer exists, or that has since been gated, should + not keep a licence to be public.""" + endpoints = {rule.endpoint for rule in _gets(gated_app)} + shortnames = {e.split('.', 1)[-1] for e in endpoints} + stale = [name for name in PUBLIC_ENDPOINTS | LOGIN_ONLY_ENDPOINTS + if name not in endpoints and name not in shortnames] + assert not stale, 'PUBLIC_ENDPOINTS names routes that do not exist: {}'.format(stale) + + +@pytest.mark.parametrize('endpoint', sorted(LOGIN_ONLY_ENDPOINTS)) +def test_a_login_only_read_refuses_an_anonymous_caller(client, gated_app, endpoint): + """These carry no permission because the handler decides from identity. + That is only sound while they still demand an identity.""" + rule = next(r for r in _gets(gated_app) if r.endpoint == endpoint) + path = rule.rule + for argument in (rule.arguments or ()): + path = path.replace(''.format(argument), '1') + path = path.replace('<{}>'.format(argument), '1') + response = client.get(path) + assert response.status_code in (401, 422), ( + '{} answered an anonymous caller with {}'.format(endpoint, + response.status_code)) diff --git a/tests/test_core/test_relationship_directional.py b/tests/test_core/test_relationship_directional.py index ce59deb6..4067b531 100644 --- a/tests/test_core/test_relationship_directional.py +++ b/tests/test_core/test_relationship_directional.py @@ -54,7 +54,7 @@ def test_list_includes_directional(client, db, auth_headers): client.post('/api/assets/relationshiptypes', json={'relationshiptype': 'WiFi', 'isdirectional': False}, headers=auth_headers) - resp = client.get('/api/assets/relationshiptypes') + resp = client.get('/api/assets/relationshiptypes', headers=auth_headers) assert resp.status_code == 200 row = next(t for t in resp.get_json()['data'] if t['relationshiptype'] == 'WiFi') @@ -88,7 +88,7 @@ def test_relationships_row_carries_isdirectional(client, db, auth_headers): relationshiptypeid=directional.relationshiptypeid)) db.session.commit() - resp = client.get(f'/api/assets/{a.assetid}/relationships') + resp = client.get(f'/api/assets/{a.assetid}/relationships', headers=auth_headers) assert resp.status_code == 200 data = resp.get_json()['data'] diff --git a/tests/test_core/test_search_coverage.py b/tests/test_core/test_search_coverage.py index d80fd3cb..a7d70eec 100644 --- a/tests/test_core/test_search_coverage.py +++ b/tests/test_core/test_search_coverage.py @@ -17,6 +17,17 @@ import pytest from shopdb.core.models import Application +@pytest.fixture(autouse=True) +def _signed_in(client, auth_headers): + """Reading needs a permission now, and these tests are about what the + payload says rather than about who may see it. Signing the client in once + beats threading headers through every helper in the module.""" + client.environ_base['HTTP_AUTHORIZATION'] = auth_headers['Authorization'] + yield + client.environ_base.pop('HTTP_AUTHORIZATION', None) + + + def search(client, query): """Global search rows for a query.""" resp = client.get(f'/api/search?q={query}') diff --git a/tests/test_core/test_security_headers.py b/tests/test_core/test_security_headers.py index 68974e3f..b20e2ae2 100644 --- a/tests/test_core/test_security_headers.py +++ b/tests/test_core/test_security_headers.py @@ -14,22 +14,22 @@ import pytest from shopdb.utils.uploads import UPLOAD_CSP -def test_every_response_carries_the_baseline_headers(client): - resp = client.get('/api/health') +def test_every_response_carries_the_baseline_headers(client, auth_headers): + resp = client.get('/api/health', headers=auth_headers) assert resp.headers.get('X-Content-Type-Options') == 'nosniff' assert resp.headers.get('X-Frame-Options') == 'SAMEORIGIN' assert resp.headers.get('Referrer-Policy') == 'strict-origin-when-cross-origin' -def test_an_error_response_carries_them_too(client): +def test_an_error_response_carries_them_too(client, auth_headers): """after_request runs for error handlers as well, which is where a response built by a different code path would otherwise slip through.""" - resp = client.get('/api/no-such-route') + resp = client.get('/api/no-such-route', headers=auth_headers) assert resp.status_code == 404 assert resp.headers.get('X-Content-Type-Options') == 'nosniff' -def test_a_served_upload_is_sandboxed(client, app, tmp_path): +def test_a_served_upload_is_sandboxed(client, app, tmp_path, auth_headers): """The uploaded file itself gets a policy that blocks script execution.""" from shopdb.core.api.applications import _appimage_dir @@ -48,7 +48,7 @@ def test_a_served_upload_is_sandboxed(client, app, tmp_path): path.write_text(svg) try: - resp = client.get('/api/applications/image/probe-headers.svg') + resp = client.get('/api/applications/image/probe-headers.svg', headers=auth_headers) assert resp.status_code == 200 assert resp.headers.get('Content-Security-Policy') == UPLOAD_CSP assert resp.headers.get('X-Content-Type-Options') == 'nosniff' diff --git a/tests/test_plugins/test_dualpath_single.py b/tests/test_plugins/test_dualpath_single.py index 551d4987..f8c128d7 100644 --- a/tests/test_plugins/test_dualpath_single.py +++ b/tests/test_plugins/test_dualpath_single.py @@ -60,11 +60,11 @@ def _set_toggle(value): # Setting ON (default): pair collapses to the primary bay # --------------------------------------------------------------------------- -def test_list_collapses_secondary_and_annotates_primary(client, db): +def test_list_collapses_secondary_and_annotates_primary(client, db, auth_headers): invalidate_settings_cache() # default on (no row) _seed_dualpath_pair() - resp = client.get('/api/machines') + resp = client.get('/api/machines', headers=auth_headers) assert resp.status_code == 200, resp.get_json() payload = resp.get_json() items = payload['data'] @@ -82,11 +82,11 @@ def test_list_collapses_secondary_and_annotates_primary(client, db): assert partner['machineid'] is not None -def test_dashboard_machine_count_collapses(client, db): +def test_dashboard_machine_count_collapses(client, db, auth_headers): invalidate_settings_cache() _seed_dualpath_pair() - resp = client.get('/api/dashboard') + resp = client.get('/api/dashboard', headers=auth_headers) assert resp.status_code == 200, resp.get_json() counts = resp.get_json()['data'] # two machine rows, one physical machine @@ -94,11 +94,11 @@ def test_dashboard_machine_count_collapses(client, db): assert counts['counts']['machines'] == 1 -def test_map_excludes_secondary_marker(client, db): +def test_map_excludes_secondary_marker(client, db, auth_headers): invalidate_settings_cache() _seed_dualpath_pair() - resp = client.get('/api/assets/map') + resp = client.get('/api/assets/map', headers=auth_headers) assert resp.status_code == 200, resp.get_json() assets = resp.get_json()['data']['assets'] numbers = [a['assetnumber'] for a in assets] @@ -109,7 +109,7 @@ def test_map_excludes_secondary_marker(client, db): assert primary['dualpathpartner'] == '2008' -def test_detail_banner_partner_shown_regardless_of_toggle(client, db): +def test_detail_banner_partner_shown_regardless_of_toggle(client, db, auth_headers): invalidate_settings_cache() primary_machine, secondary_machine = _seed_dualpath_pair() @@ -119,7 +119,7 @@ def test_detail_banner_partner_shown_regardless_of_toggle(client, db): (primary_machine.machineid, '2008'), (secondary_machine.machineid, '2007'), ): - resp = client.get(f'/api/machines/{machine_id}') + resp = client.get(f'/api/machines/{machine_id}', headers=auth_headers) assert resp.status_code == 200, resp.get_json() partner = resp.get_json()['data']['dualpathpartner'] assert partner is not None @@ -130,11 +130,11 @@ def test_detail_banner_partner_shown_regardless_of_toggle(client, db): # Setting OFF: both bays list and count separately # --------------------------------------------------------------------------- -def test_list_shows_both_bays_when_disabled(client, db): +def test_list_shows_both_bays_when_disabled(client, db, auth_headers): _seed_dualpath_pair() _set_toggle(False) - resp = client.get('/api/machines') + resp = client.get('/api/machines', headers=auth_headers) assert resp.status_code == 200, resp.get_json() payload = resp.get_json() numbers = sorted(i['assetnumber'] for i in payload['data']) @@ -143,20 +143,20 @@ def test_list_shows_both_bays_when_disabled(client, db): assert payload['meta']['pagination']['total'] == 2 -def test_dashboard_counts_both_bays_when_disabled(client, db): +def test_dashboard_counts_both_bays_when_disabled(client, db, auth_headers): _seed_dualpath_pair() _set_toggle(False) - resp = client.get('/api/dashboard') + resp = client.get('/api/dashboard', headers=auth_headers) assert resp.status_code == 200, resp.get_json() assert resp.get_json()['data']['totalmachines'] == 2 -def test_map_shows_both_bays_when_disabled(client, db): +def test_map_shows_both_bays_when_disabled(client, db, auth_headers): _seed_dualpath_pair() _set_toggle(False) - resp = client.get('/api/assets/map') + resp = client.get('/api/assets/map', headers=auth_headers) assert resp.status_code == 200, resp.get_json() numbers = [a['assetnumber'] for a in resp.get_json()['data']['assets']] assert '2007' in numbers diff --git a/tests/test_plugins/test_employee_photo.py b/tests/test_plugins/test_employee_photo.py index 7de0142a..664c7fbe 100644 --- a/tests/test_plugins/test_employee_photo.py +++ b/tests/test_plugins/test_employee_photo.py @@ -123,7 +123,7 @@ def test_serve_returns_bytes(client, db, auth_headers): client.post(f'/api/employees/{emp.sso}/photo', data=data, content_type='multipart/form-data', headers=auth_headers) - served = client.get(f'{EMPLOYEE_PHOTO_URL_PREFIX}photo-{emp.sso}.png') + served = client.get(f'{EMPLOYEE_PHOTO_URL_PREFIX}photo-{emp.sso}.png', headers=auth_headers) assert served.status_code == 200 assert served.get_data() == payload @@ -207,6 +207,6 @@ def test_lookup_includes_photourl(client, db, auth_headers): client.post(f'/api/employees/{emp.sso}/photo', data=data, content_type='multipart/form-data', headers=auth_headers) - resp = client.get(f'/api/employees/lookup/{emp.sso}') + resp = client.get(f'/api/employees/lookup/{emp.sso}', headers=auth_headers) assert resp.status_code == 200 assert resp.get_json()['data']['photourl'] == f'{EMPLOYEE_PHOTO_URL_PREFIX}photo-{emp.sso}.png' diff --git a/tests/test_plugins/test_knowledgebase_search_words.py b/tests/test_plugins/test_knowledgebase_search_words.py index e26e15f6..341aad75 100644 --- a/tests/test_plugins/test_knowledgebase_search_words.py +++ b/tests/test_plugins/test_knowledgebase_search_words.py @@ -22,6 +22,17 @@ from shopdb.core.models import Application from plugins.knowledgebase.models import KnowledgeBase +@pytest.fixture(autouse=True) +def _signed_in(client, auth_headers): + """Reading needs a permission now, and these tests are about what the + payload says rather than about who may see it. Signing the client in once + beats threading headers through every helper in the module.""" + client.environ_base['HTTP_AUTHORIZATION'] = auth_headers['Authorization'] + yield + client.environ_base.pop('HTTP_AUTHORIZATION', None) + + + @pytest.fixture def library(db): """Articles whose identifying words are deliberately spread across fields.""" diff --git a/tests/test_plugins/test_knowledgebase_visibility.py b/tests/test_plugins/test_knowledgebase_visibility.py index 3d8870a4..f6412586 100644 --- a/tests/test_plugins/test_knowledgebase_visibility.py +++ b/tests/test_plugins/test_knowledgebase_visibility.py @@ -15,6 +15,17 @@ from shopdb.core.models import Application from plugins.knowledgebase.models import KnowledgeBase +@pytest.fixture(autouse=True) +def _signed_in(client, auth_headers): + """Reading needs a permission now, and these tests are about what the + payload says rather than about who may see it. Signing the client in once + beats threading headers through every helper in the module.""" + client.environ_base['HTTP_AUTHORIZATION'] = auth_headers['Authorization'] + yield + client.environ_base.pop('HTTP_AUTHORIZATION', None) + + + @pytest.fixture def library(db): """One application of each interesting shape, with an article each.""" @@ -84,7 +95,7 @@ def test_searching_a_title_does_not_resurrect_a_retired_article(client, library) assert 'Live runbook' in found -def test_the_counts_agree_with_the_list(client, library): +def test_the_counts_agree_with_the_list(client, library, auth_headers): """A total that includes articles nobody can see is a total nobody can reconcile against the page.""" visible = titles(client) @@ -97,10 +108,11 @@ def test_the_counts_agree_with_the_list(client, library): assert clicks == 6 -def test_the_topic_list_offers_every_active_application(client, library): +def test_the_topic_list_offers_every_active_application(client, library, auth_headers): """What the article form's topic dropdown fetches. Installable or not, hidden or not - only retired is excluded.""" - offered = sorted(row['appname'] for row in client.get( - '/api/applications?perpage=100&showhidden=true').get_json()['data']) + response = client.get('/api/applications?perpage=100&showhidden=true', + headers=auth_headers) + offered = sorted(row['appname'] for row in response.get_json()['data']) assert offered == ['Hidden App', 'Live App', 'Manual App'] assert 'Retired App' not in offered diff --git a/tests/test_plugins/test_list_search_type_columns.py b/tests/test_plugins/test_list_search_type_columns.py index 1b7f7e94..71ad6c8d 100644 --- a/tests/test_plugins/test_list_search_type_columns.py +++ b/tests/test_plugins/test_list_search_type_columns.py @@ -28,7 +28,7 @@ def _numbers(resp): return sorted(item['assetnumber'] for item in resp.get_json()['data']) -def test_pcs_search_matches_computer_type(client, db): +def test_pcs_search_matches_computer_type(client, db, auth_headers): assettype = _assettype('computer') standard = ComputerType(computertype='Standard') _db.session.add(standard) @@ -45,16 +45,16 @@ def test_pcs_search_matches_computer_type(client, db): ]) _db.session.commit() - resp = client.get('/api/computers?search=Standard') + resp = client.get('/api/computers?search=Standard', headers=auth_headers) assert resp.status_code == 200, resp.get_json() assert _numbers(resp) == ['PC-1'] # the typeless PC is still findable on its own fields - resp = client.get('/api/computers?search=bench') + resp = client.get('/api/computers?search=bench', headers=auth_headers) assert _numbers(resp) == ['PC-2'] -def test_printers_search_matches_type_and_model(client, db): +def test_printers_search_matches_type_and_model(client, db, auth_headers): assettype = _assettype('printer') thermal = PrinterType(printertype='Thermal') model = Model(modelnumber='ZT411') @@ -74,15 +74,15 @@ def test_printers_search_matches_type_and_model(client, db): _db.session.commit() for term in ['Thermal', 'ZT411']: - resp = client.get(f'/api/printers?search={term}') + resp = client.get(f'/api/printers?search={term}', headers=auth_headers) assert resp.status_code == 200, resp.get_json() assert _numbers(resp) == ['PR-1'], term - resp = client.get('/api/printers?search=plotter') + resp = client.get('/api/printers?search=plotter', headers=auth_headers) assert _numbers(resp) == ['PR-2'] -def test_network_search_matches_type_and_vendor(client, db): +def test_network_search_matches_type_and_vendor(client, db, auth_headers): assettype = _assettype('network_device') switchtype = NetworkDeviceType(networkdevicetype='Switch') vendor = Vendor(vendor='Cisco') @@ -103,15 +103,15 @@ def test_network_search_matches_type_and_vendor(client, db): _db.session.commit() for term in ['Switch', 'Cisco']: - resp = client.get(f'/api/network?search={term}') + resp = client.get(f'/api/network?search={term}', headers=auth_headers) assert resp.status_code == 200, resp.get_json() assert _numbers(resp) == ['NET-1'], term - resp = client.get('/api/network?search=hub') + resp = client.get('/api/network?search=hub', headers=auth_headers) assert _numbers(resp) == ['NET-2'] -def test_measuringtools_search_matches_type(client, db): +def test_measuringtools_search_matches_type(client, db, auth_headers): assettype = _assettype('measuring_tool') caliper = MeasuringToolType(name='Caliper') _db.session.add(caliper) @@ -129,15 +129,15 @@ def test_measuringtools_search_matches_type(client, db): ]) _db.session.commit() - resp = client.get('/api/measuringtools?search=Caliper') + resp = client.get('/api/measuringtools?search=Caliper', headers=auth_headers) assert resp.status_code == 200, resp.get_json() assert _numbers(resp) == ['MT-1'] - resp = client.get('/api/measuringtools?search=height') + resp = client.get('/api/measuringtools?search=height', headers=auth_headers) assert _numbers(resp) == ['MT-2'] -def test_core_assets_search_matches_asset_type(client, db): +def test_core_assets_search_matches_asset_type(client, db, auth_headers): """The unified asset list shows a Type column too.""" machine_type = _assettype('machine') printer_type = _assettype('printer') @@ -147,12 +147,12 @@ def test_core_assets_search_matches_asset_type(client, db): ]) _db.session.commit() - resp = client.get('/api/assets?search=machine') + resp = client.get('/api/assets?search=machine', headers=auth_headers) assert resp.status_code == 200, resp.get_json() assert _numbers(resp) == ['A-1'] -def test_core_assets_search_type_filter_still_works(client, db): +def test_core_assets_search_type_filter_still_works(client, db, auth_headers): """The type-name filter joins AssetType; search uses EXISTS, so both apply.""" machine_type = _assettype('machine') _db.session.add_all([ @@ -161,6 +161,6 @@ def test_core_assets_search_type_filter_still_works(client, db): ]) _db.session.commit() - resp = client.get('/api/assets?type=machine&search=mill') + resp = client.get('/api/assets?type=machine&search=mill', headers=auth_headers) assert resp.status_code == 200, resp.get_json() assert _numbers(resp) == ['A-1'] diff --git a/tests/test_plugins/test_machines_search.py b/tests/test_plugins/test_machines_search.py index 1ef0537b..800c13f7 100644 --- a/tests/test_plugins/test_machines_search.py +++ b/tests/test_plugins/test_machines_search.py @@ -47,49 +47,49 @@ def _numbers(resp): return sorted(item['assetnumber'] for item in resp.get_json()['data']) -def test_search_matches_machine_type_name(client, db): +def test_search_matches_machine_type_name(client, db, auth_headers): _seed_machines() - resp = client.get('/api/machines?search=Part Washer') + resp = client.get('/api/machines?search=Part Washer', headers=auth_headers) assert resp.status_code == 200, resp.get_json() assert _numbers(resp) == ['0410'] -def test_search_matches_vendor_name(client, db): +def test_search_matches_vendor_name(client, db, auth_headers): _seed_machines() - resp = client.get('/api/machines?search=Acme') + resp = client.get('/api/machines?search=Acme', headers=auth_headers) assert resp.status_code == 200, resp.get_json() assert _numbers(resp) == ['0410'] -def test_search_still_matches_asset_fields(client, db): +def test_search_still_matches_asset_fields(client, db, auth_headers): _seed_machines() for term, expected in [('0999', ['0999']), ('Old lathe', ['0999']), ('SN-WASH', ['0410'])]: - resp = client.get(f'/api/machines?search={term}') + resp = client.get(f'/api/machines?search={term}', headers=auth_headers) assert resp.status_code == 200, resp.get_json() assert _numbers(resp) == expected, term -def test_search_does_not_drop_machines_without_type_or_vendor(client, db): +def test_search_does_not_drop_machines_without_type_or_vendor(client, db, auth_headers): """The outer joins must not turn into inner joins.""" _seed_machines() - resp = client.get('/api/machines?search=lathe') + resp = client.get('/api/machines?search=lathe', headers=auth_headers) assert resp.status_code == 200, resp.get_json() assert _numbers(resp) == ['0999'] -def test_search_miss_returns_empty(client, db): +def test_search_miss_returns_empty(client, db, auth_headers): _seed_machines() - resp = client.get('/api/machines?search=zzzznotathing') + resp = client.get('/api/machines?search=zzzznotathing', headers=auth_headers) assert resp.status_code == 200, resp.get_json() assert _numbers(resp) == [] diff --git a/tests/test_plugins/test_measuringtools.py b/tests/test_plugins/test_measuringtools.py index cee57943..b4fa210a 100644 --- a/tests/test_plugins/test_measuringtools.py +++ b/tests/test_plugins/test_measuringtools.py @@ -20,9 +20,20 @@ from shopdb import create_app from shopdb.extensions import db as _db from shopdb.plugins import plugin_manager from plugins.measuringtools.models import ( + derive_status, DUESOON_WINDOW_DAYS, STATUS_COLORS) +@pytest.fixture(autouse=True) +def _signed_in(client, auth_headers): + """Reading needs a permission now, and these tests are about what the + payload says rather than about who may see it. Signing the client in once + beats threading headers through every helper in the module.""" + client.environ_base['HTTP_AUTHORIZATION'] = auth_headers['Authorization'] + yield + client.environ_base.pop('HTTP_AUTHORIZATION', None) + + # ============================================================================= # Pure unit tests: derived status (no app needed) # ============================================================================= @@ -48,7 +59,7 @@ def test_derive_status_duesoon_on_boundary(): assert derive_status(date.today() + timedelta(days=DUESOON_WINDOW_DAYS)) == 'duesoon' -def test_derive_status_duesoon_today(): +def test_derive_status_duesoon_today(auth_headers): """Due today is not yet overdue - it falls in the due-soon window.""" assert derive_status(date.today()) == 'duesoon' @@ -120,14 +131,17 @@ def _status_id(client): # -- Type CRUD + in-use guard ------------------------------------------------- -def test_starter_types_seeded(client): - response = client.get('/api/measuringtools/types') +def test_starter_types_seeded(client, auth_headers): + response = client.get('/api/measuringtools/types', headers=auth_headers) assert response.status_code == 200 names = {t['name'] for t in response.get_json()['data']} assert {'Caliper', 'Micrometer', 'Thread Gage', 'Other'} <= names def test_type_create_requires_auth(client): + # This module signs the client in for every test; this one is about what + # happens when nobody is signed in, so it takes that back. + client.environ_base.pop('HTTP_AUTHORIZATION', None) response = client.post('/api/measuringtools/types', json={'name': 'Nope'}) assert response.status_code == 401 @@ -197,7 +211,7 @@ def test_tool_create_and_get_merged(client, auth_headers): assert ext['calibrationstatus'] == 'current' tool_id = ext['measuringtoolid'] - fetched = client.get(f'/api/measuringtools/{tool_id}') + fetched = client.get(f'/api/measuringtools/{tool_id}', headers=auth_headers) assert fetched.status_code == 200 assert fetched.get_json()['data']['measuringtool']['measuringtoolid'] == tool_id @@ -263,7 +277,7 @@ def test_list_filter_by_calibrationstatus(client, auth_headers): 'assetnumber': 'MT-OVERDUE-1', 'statusid': _status_id(client), 'nextcalibrationdate': str(date.today() - timedelta(days=10)), }) - response = client.get('/api/measuringtools?calibrationstatus=overdue') + response = client.get('/api/measuringtools?calibrationstatus=overdue', headers=auth_headers) assert response.status_code == 200 rows = response.get_json()['data'] assert rows, 'expected at least one overdue tool' @@ -341,7 +355,7 @@ def test_search_excludes_tools_when_domain_disabled(mt_app, client, auth_headers # -- Report shape ------------------------------------------------------------- def test_calibration_report_shape(client, auth_headers): - response = client.get('/api/measuringtools/report/calibration') + response = client.get('/api/measuringtools/report/calibration', headers=auth_headers) assert response.status_code == 200 data = response.get_json()['data'] assert set(data['counts']) == {'overdue', 'duesoon', 'current', 'unknown'} @@ -382,7 +396,7 @@ def test_asset_todict_carries_measuringtool_typedata_and_pluginid(mt_app, client def test_map_lists_measuringtool_subtypes(client, auth_headers): """The map filter dropdown carries a Measuring Tool subtype list with color.""" - response = client.get('/api/assets/map') + response = client.get('/api/assets/map', headers=auth_headers) assert response.status_code == 200, response.get_json() subtypes = response.get_json()['data']['filters']['subtypes'] assert 'Measuring Tool' in subtypes @@ -404,7 +418,7 @@ def test_map_honors_measuringtool_subtype_filter(client, auth_headers): 'measuringtooltypeid': micrometer_id, 'mapx': 30, 'mapy': 40}) response = client.get( - f'/api/assets/map?assettype=measuring_tool&subtype={caliper_id}') + f'/api/assets/map?assettype=measuring_tool&subtype={caliper_id}', headers=auth_headers) assert response.status_code == 200, response.get_json() numbers = {a['assetnumber'] for a in response.get_json()['data']['assets']} assert 'MT-MAP-CAL' in numbers @@ -416,7 +430,7 @@ def test_map_item_carries_measuringtool_typedata(client, auth_headers): client.post('/api/measuringtools', headers=auth_headers, json={ 'assetnumber': 'MT-MAP-TD', 'statusid': _status_id(client), 'measuringtooltypeid': _caliper_id(client), 'mapx': 55, 'mapy': 66}) - response = client.get('/api/assets/map?assettype=measuring_tool') + response = client.get('/api/assets/map?assettype=measuring_tool', headers=auth_headers) item = next(a for a in response.get_json()['data']['assets'] if a['assetnumber'] == 'MT-MAP-TD') assert item['typedata']['measuringtooltypename'] == 'Caliper' @@ -444,7 +458,7 @@ def test_map_overlay_shape_and_derivation(client, auth_headers): 'nextcalibrationdate': str(date.today() - timedelta(days=3))}) # overdue assetid = created.get_json()['data']['assetid'] - response = client.get('/api/measuringtools/map-overlay') + response = client.get('/api/measuringtools/map-overlay', headers=auth_headers) assert response.status_code == 200, response.get_json() rows = response.get_json()['data'] # ADR-010 overlay contract: [{assetid, color, label}], only due/overdue tools. diff --git a/tests/test_plugins/test_model_image_in_detail.py b/tests/test_plugins/test_model_image_in_detail.py index 4b49f836..e31182e5 100644 --- a/tests/test_plugins/test_model_image_in_detail.py +++ b/tests/test_plugins/test_model_image_in_detail.py @@ -39,55 +39,55 @@ def _seed_model(imageurl=IMAGE_URL): return model -def test_machine_detail_carries_model_imageurl(client, db): +def test_machine_detail_carries_model_imageurl(client, db, auth_headers): asset = _seed_asset('2001', 'machine') model = _seed_model() machine = Machine(assetid=asset.assetid, modelnumberid=model.modelnumberid) _db.session.add(machine) _db.session.commit() - resp = client.get(f'/api/machines/{machine.machineid}') + resp = client.get(f'/api/machines/{machine.machineid}', headers=auth_headers) assert resp.status_code == 200, resp.get_json() assert resp.get_json()['data']['machine']['imageurl'] == IMAGE_URL -def test_computer_detail_carries_model_imageurl(client, db): +def test_computer_detail_carries_model_imageurl(client, db, auth_headers): asset = _seed_asset('PC-2001', 'computer') model = _seed_model() computer = Computer(assetid=asset.assetid, modelnumberid=model.modelnumberid) _db.session.add(computer) _db.session.commit() - resp = client.get(f'/api/computers/{computer.computerid}') + resp = client.get(f'/api/computers/{computer.computerid}', headers=auth_headers) assert resp.status_code == 200, resp.get_json() assert resp.get_json()['data']['computer']['imageurl'] == IMAGE_URL -def test_printer_detail_carries_model_imageurl(client, db): +def test_printer_detail_carries_model_imageurl(client, db, auth_headers): asset = _seed_asset('PR-2001', 'printer') model = _seed_model() printer = Printer(assetid=asset.assetid, modelnumberid=model.modelnumberid) _db.session.add(printer) _db.session.commit() - resp = client.get(f'/api/printers/{printer.printerid}') + resp = client.get(f'/api/printers/{printer.printerid}', headers=auth_headers) assert resp.status_code == 200, resp.get_json() assert resp.get_json()['data']['printer']['imageurl'] == IMAGE_URL -def test_detail_omits_imageurl_without_model(client, db): +def test_detail_omits_imageurl_without_model(client, db, auth_headers): """No model linked -> no imageurl key (frontend v-if shows nothing).""" asset = _seed_asset('PR-2002', 'printer') printer = Printer(assetid=asset.assetid) _db.session.add(printer) _db.session.commit() - resp = client.get(f'/api/printers/{printer.printerid}') + resp = client.get(f'/api/printers/{printer.printerid}', headers=auth_headers) assert resp.status_code == 200, resp.get_json() assert 'imageurl' not in resp.get_json()['data']['printer'] -def test_detail_omits_imageurl_when_model_has_no_image(client, db): +def test_detail_omits_imageurl_when_model_has_no_image(client, db, auth_headers): """Model linked but no photo -> no imageurl key.""" asset = _seed_asset('PC-2002', 'computer') model = _seed_model(imageurl=None) @@ -95,6 +95,6 @@ def test_detail_omits_imageurl_when_model_has_no_image(client, db): _db.session.add(computer) _db.session.commit() - resp = client.get(f'/api/computers/{computer.computerid}') + resp = client.get(f'/api/computers/{computer.computerid}', headers=auth_headers) assert resp.status_code == 200, resp.get_json() assert 'imageurl' not in resp.get_json()['data']['computer'] diff --git a/tests/test_plugins/test_modelsupplies.py b/tests/test_plugins/test_modelsupplies.py index f83d6e76..a0062862 100644 --- a/tests/test_plugins/test_modelsupplies.py +++ b/tests/test_plugins/test_modelsupplies.py @@ -18,8 +18,8 @@ def model(db): return model -def test_supplies_meta_lists_allowed_values(client, db): - response = client.get('/api/printers/supplies/meta') +def test_supplies_meta_lists_allowed_values(client, db, auth_headers): + response = client.get('/api/printers/supplies/meta', headers=auth_headers) assert response.status_code == 200 data = response.get_json()['data'] assert 'toner' in data['supplytypes'] @@ -38,7 +38,7 @@ def test_create_and_list_model_supply(client, model, auth_headers): ) assert create.status_code == 201 - listing = client.get(f'/api/printers/models/{model.modelnumberid}/supplies') + listing = client.get(f'/api/printers/models/{model.modelnumberid}/supplies', headers=auth_headers) assert listing.status_code == 200 supplies = listing.get_json()['data']['supplies'] assert len(supplies) == 1 @@ -90,7 +90,7 @@ def test_update_and_delete_supply(client, model, auth_headers): deleted = client.delete(f'/api/printers/supplies/{supplyid}', headers=auth_headers) assert deleted.status_code == 200 - listing = client.get(f'/api/printers/models/{model.modelnumberid}/supplies') + listing = client.get(f'/api/printers/models/{model.modelnumberid}/supplies', headers=auth_headers) assert listing.get_json()['data']['supplies'] == [] @@ -98,7 +98,7 @@ def test_listmodels_reports_supplycount(client, model, auth_headers): client.post(f'/api/printers/models/{model.modelnumberid}/supplies', json={'partnumber': 'W2020A', 'color': 'black'}, headers=auth_headers) - response = client.get('/api/printers/models', query_string={'search': 'C999'}) + response = client.get('/api/printers/models', query_string={'search': 'C999'}, headers=auth_headers) assert response.status_code == 200 rows = response.get_json()['data'] match = next(r for r in rows if r['modelnumberid'] == model.modelnumberid) diff --git a/tests/test_plugins/test_printedparts_ledger.py b/tests/test_plugins/test_printedparts_ledger.py index 0257ba03..993c8578 100644 --- a/tests/test_plugins/test_printedparts_ledger.py +++ b/tests/test_plugins/test_printedparts_ledger.py @@ -148,20 +148,20 @@ def test_kiosk_take_is_open_decrement_only(client, auth_headers, app, item, headers=auth_headers) assert stocked.status_code == 200 - lookup = client.get(f'/api/printedparts/kiosk/item/{itemcode}') + lookup = client.get(f'/api/printedparts/kiosk/item/{itemcode}', headers=auth_headers) assert lookup.status_code == 200 take = client.post('/api/printedparts/kiosk/take', json={ - 'itemcode': itemcode, 'badge': directory_employee, 'quantity': 2}) + 'itemcode': itemcode, 'badge': directory_employee, 'quantity': 2}, headers=auth_headers) assert take.status_code == 200, take.get_json() assert take.get_json()['data']['quantityonhand'] == 3 too_many = client.post('/api/printedparts/kiosk/take', json={ - 'itemcode': itemcode, 'badge': directory_employee, 'quantity': 99}) + 'itemcode': itemcode, 'badge': directory_employee, 'quantity': 99}, headers=auth_headers) assert too_many.status_code == 400 unknown = client.post('/api/printedparts/kiosk/take', json={ - 'itemcode': itemcode, 'badge': '111111111', 'quantity': 1}) + 'itemcode': itemcode, 'badge': '111111111', 'quantity': 1}, headers=auth_headers) assert unknown.status_code == 422 with app.app_context(): @@ -197,7 +197,7 @@ def test_lowstock_alert_fires_on_crossing_only(client, auth_headers, app, item, return client.post('/api/printedparts/kiosk/take', json={'itemcode': '3DP-9001', 'badge': directory_employee, - 'quantity': quantity}) + 'quantity': quantity}, headers=auth_headers) restock(10) # 10 on hand, threshold 5 assert take(3).status_code == 200 # 7: above threshold, no alert @@ -245,7 +245,7 @@ def test_alert_recipients_merge_users_and_freetext(client, auth_headers, app, headers=auth_headers) take = client.post('/api/printedparts/kiosk/take', json={'itemcode': '3DP-9001', - 'badge': directory_employee, 'quantity': 6}) + 'badge': directory_employee, 'quantity': 6}, headers=auth_headers) assert take.status_code == 200 # 4 on hand: crossed threshold 5 assert captured['to'] == ['lead@site.test', 'extra@site.test'] @@ -260,7 +260,7 @@ def test_retire_hides_and_restore_returns(client, auth_headers, item): listed = client.get('/api/printedparts/items', headers=auth_headers).get_json()['data'] assert all(row['printeditemid'] != item for row in listed) - kiosk = client.get('/api/printedparts/kiosk/item/3DP-9001') + kiosk = client.get('/api/printedparts/kiosk/item/3DP-9001', headers=auth_headers) assert kiosk.status_code == 404 including = client.get('/api/printedparts/items?active=false', @@ -270,7 +270,7 @@ def test_retire_hides_and_restore_returns(client, auth_headers, item): assert client.post(f'/api/printedparts/items/{item}/restore', headers=auth_headers).status_code == 200 - assert client.get('/api/printedparts/kiosk/item/3DP-9001').status_code == 200 + assert client.get('/api/printedparts/kiosk/item/3DP-9001', headers=auth_headers).status_code == 200 def test_file_revisions_append_and_download(client, auth_headers, item, tmp_path): @@ -302,7 +302,7 @@ def test_file_revisions_append_and_download(client, auth_headers, item, tmp_path assert [f['revision'] for f in listing] == [2, 1] fileid = listing[1]['fileid'] - download = client.get(f'/api/printedparts/files/{fileid}/download') + download = client.get(f'/api/printedparts/files/{fileid}/download', headers=auth_headers) assert download.status_code == 200 assert download.data == b'solid part' assert 'clip_v1.stl' in download.headers['Content-Disposition'] @@ -335,7 +335,7 @@ def test_alert_role_members_receive(client, auth_headers, app, item, headers=auth_headers) take = client.post('/api/printedparts/kiosk/take', json={'itemcode': '3DP-9001', - 'badge': directory_employee, 'quantity': 6}) + 'badge': directory_employee, 'quantity': 6}, headers=auth_headers) assert take.status_code == 200 assert captured['to'] == ['crewone@site.test'] @@ -362,14 +362,14 @@ def test_gagelabtag_assigned_searched_and_kiosk_resolved(client, auth_headers): headers=auth_headers).get_json()['data'] assert len(searched) == 1 - by_tag = client.get('/api/printedparts/kiosk/item/WJRP0117') + by_tag = client.get('/api/printedparts/kiosk/item/WJRP0117', headers=auth_headers) assert by_tag.status_code == 200 - by_digits = client.get('/api/printedparts/kiosk/item/117') + by_digits = client.get('/api/printedparts/kiosk/item/117', headers=auth_headers) assert by_digits.status_code == 200 assert by_digits.get_json()['data']['gagelabtag'] == 'WJRP0117' -def test_kiosk_take_records_revision_from_qr(client, app, db, directory_employee): +def test_kiosk_take_records_revision_from_qr(client, app, db, directory_employee, auth_headers): """A label QR payload 'TAG|rev' resolves the item by TAG and records the revision on the take (traceability of which print-file rev was consumed).""" with app.app_context(): @@ -380,7 +380,7 @@ def test_kiosk_take_records_revision_from_qr(client, app, db, directory_employee iid = row.printeditemid take = client.post('/api/printedparts/kiosk/take', json={ - 'itemcode': 'WJRP7000|3', 'badge': directory_employee, 'quantity': 1}) + 'itemcode': 'WJRP7000|3', 'badge': directory_employee, 'quantity': 1}, headers=auth_headers) assert take.status_code == 200, take.get_json() with app.app_context(): @@ -391,7 +391,7 @@ def test_kiosk_take_records_revision_from_qr(client, app, db, directory_employee # Manual entry (no |rev) records a null revision, still resolves. take2 = client.post('/api/printedparts/kiosk/take', json={ - 'itemcode': 'WJRP7000', 'badge': directory_employee, 'quantity': 1}) + 'itemcode': 'WJRP7000', 'badge': directory_employee, 'quantity': 1}, headers=auth_headers) assert take2.status_code == 200 with app.app_context(): last = (PrintedItemTransaction.query @@ -400,7 +400,7 @@ def test_kiosk_take_records_revision_from_qr(client, app, db, directory_employee assert last.revision is None -def test_lowstock_routes_to_support_team_webhook(client, app, db, directory_employee): +def test_lowstock_routes_to_support_team_webhook(client, app, db, directory_employee, auth_headers): """A low-stock crossing posts to the selected support team's webhook URL.""" from unittest.mock import patch from shopdb.core.models import SupportTeam, Setting @@ -418,7 +418,7 @@ def test_lowstock_routes_to_support_team_webhook(client, app, db, directory_empl with patch('shopdb.api.send_webhook') as mock_send: # take 2 -> 6 crosses to 4 (<= threshold 5) -> alert fires resp = client.post('/api/printedparts/kiosk/take', json={ - 'itemcode': 'WJRP7100', 'badge': directory_employee, 'quantity': 2}) + 'itemcode': 'WJRP7100', 'badge': directory_employee, 'quantity': 2}, headers=auth_headers) assert resp.status_code == 200, resp.get_json() assert mock_send.called assert mock_send.call_args.kwargs['url'] == 'https://teams.example/3dprint' diff --git a/tests/test_plugins/test_supply_history.py b/tests/test_plugins/test_supply_history.py index 00705be8..654f8c36 100644 --- a/tests/test_plugins/test_supply_history.py +++ b/tests/test_plugins/test_supply_history.py @@ -299,10 +299,10 @@ def test_no_estimate_never_reaches_the_order_list(): assert orderlist([cartridge(None)]) == [] -def test_forecast_endpoint_says_so_when_zabbix_is_absent(client, db): +def test_forecast_endpoint_says_so_when_zabbix_is_absent(client, db, auth_headers): """A dashboard must be told the data is missing, not shown an empty list that reads as 'nothing runs out soon'.""" - response = client.get('/api/printers/supplies/forecast') + response = client.get('/api/printers/supplies/forecast', headers=auth_headers) assert response.status_code == 200 body = response.get_json()['data'] diff --git a/tests/test_plugins/test_toner_forecast_report.py b/tests/test_plugins/test_toner_forecast_report.py index 55cadbb5..36000e13 100644 --- a/tests/test_plugins/test_toner_forecast_report.py +++ b/tests/test_plugins/test_toner_forecast_report.py @@ -14,6 +14,17 @@ from shopdb.core.models import Model, Vendor from plugins.printers.models import ModelSupply, Printer +@pytest.fixture(autouse=True) +def _signed_in(client, auth_headers): + """Reading needs a permission now, and these tests are about what the + payload says rather than about who may see it. Signing the client in once + beats threading headers through every helper in the module.""" + client.environ_base['HTTP_AUTHORIZATION'] = auth_headers['Authorization'] + yield + client.environ_base.pop('HTTP_AUTHORIZATION', None) + + + LEVELS = { # itemid: (name, live level, history of daily readings) # Black is a REAL zero, which is the only thing that means empty. Magenta is