Reading anything needs a permission

A sweep of the URL map found 165 GET routes that answered anybody, with no
token at all: the whole asset inventory, every machine, PC, printer and network
device, the USB checkout history and who is holding which drive, the staff
directory with its photographs, every core report. Guest access had been argued
about one feature-flag at a time while the front door stood open.

Each of those now carries the read permission it belongs to. That also makes
the guest role mean something: a site can open exactly the reads it chooses,
and nothing follows by accident.

Thirty-three endpoints stay public, and each is named with its reason rather
than left to be inferred: the app shell and its bootstrap, the settings
allowlist (the handler already filters an anonymous caller down to branding and
a few keys), images fetched by <img src> which carries no Authorization header,
what a display kiosk renders before anybody signs in, the parts and USB kiosks,
the client scripts that run as SYSTEM before a user session exists, and a
secure-send link whose unguessable token IS the authorisation.

tests/test_core/test_public_read_surface.py is the standing gate, the companion
to the mutating-route sweep that has guarded writes for months. A new public
read fails CI until somebody adds it to that list in front of a reviewer. Four
further reads need a login but no permission, because the handler decides from
who you are - your own user record, your own API tokens, the role catalogue the
grid renders - and the same test proves each still refuses an anonymous caller.
Verified not vacuous by ungating one route and watching the sweep name it.

The employees plugin gained employees.view; the directory is names, SSOs,
photographs and reporting lines, and it had no permission of any kind.

Around ninety tests asserted payload shapes against endpoints that answered
anybody. They are about what the answer says, not about who may ask, so they
are signed in now rather than the gate being loosened. The ones that assert an
anonymous caller is refused were left exactly as they were.

tests/test_plugins/test_printedparts_ledger.py

@@ -148,20 +148,20 @@ def test_kiosk_take_is_open_decrement_only(client, auth_headers, app, item,
                           headers=auth_headers)
     assert stocked.status_code == 200
 
-    lookup = client.get(f'/api/printedparts/kiosk/item/{itemcode}')
+    lookup = client.get(f'/api/printedparts/kiosk/item/{itemcode}', headers=auth_headers)
     assert lookup.status_code == 200
 
     take = client.post('/api/printedparts/kiosk/take', json={
-        'itemcode': itemcode, 'badge': directory_employee, 'quantity': 2})
+        'itemcode': itemcode, 'badge': directory_employee, 'quantity': 2}, headers=auth_headers)
     assert take.status_code == 200, take.get_json()
     assert take.get_json()['data']['quantityonhand'] == 3
 
     too_many = client.post('/api/printedparts/kiosk/take', json={
-        'itemcode': itemcode, 'badge': directory_employee, 'quantity': 99})
+        'itemcode': itemcode, 'badge': directory_employee, 'quantity': 99}, headers=auth_headers)
     assert too_many.status_code == 400
 
     unknown = client.post('/api/printedparts/kiosk/take', json={
-        'itemcode': itemcode, 'badge': '111111111', 'quantity': 1})
+        'itemcode': itemcode, 'badge': '111111111', 'quantity': 1}, headers=auth_headers)
     assert unknown.status_code == 422
 
     with app.app_context():
@@ -197,7 +197,7 @@ def test_lowstock_alert_fires_on_crossing_only(client, auth_headers, app, item,
         return client.post('/api/printedparts/kiosk/take',
                            json={'itemcode': '3DP-9001',
                                  'badge': directory_employee,
-                                 'quantity': quantity})
+                                 'quantity': quantity}, headers=auth_headers)
 
     restock(10)                      # 10 on hand, threshold 5
     assert take(3).status_code == 200   # 7: above threshold, no alert
@@ -245,7 +245,7 @@ def test_alert_recipients_merge_users_and_freetext(client, auth_headers, app,
                 headers=auth_headers)
     take = client.post('/api/printedparts/kiosk/take',
                        json={'itemcode': '3DP-9001',
-                             'badge': directory_employee, 'quantity': 6})
+                             'badge': directory_employee, 'quantity': 6}, headers=auth_headers)
     assert take.status_code == 200          # 4 on hand: crossed threshold 5
 
     assert captured['to'] == ['lead@site.test', 'extra@site.test']
@@ -260,7 +260,7 @@ def test_retire_hides_and_restore_returns(client, auth_headers, item):
     listed = client.get('/api/printedparts/items',
                         headers=auth_headers).get_json()['data']
     assert all(row['printeditemid'] != item for row in listed)
-    kiosk = client.get('/api/printedparts/kiosk/item/3DP-9001')
+    kiosk = client.get('/api/printedparts/kiosk/item/3DP-9001', headers=auth_headers)
     assert kiosk.status_code == 404
 
     including = client.get('/api/printedparts/items?active=false',
@@ -270,7 +270,7 @@ def test_retire_hides_and_restore_returns(client, auth_headers, item):
 
     assert client.post(f'/api/printedparts/items/{item}/restore',
                        headers=auth_headers).status_code == 200
-    assert client.get('/api/printedparts/kiosk/item/3DP-9001').status_code == 200
+    assert client.get('/api/printedparts/kiosk/item/3DP-9001', headers=auth_headers).status_code == 200
 
 
 def test_file_revisions_append_and_download(client, auth_headers, item, tmp_path):
@@ -302,7 +302,7 @@ def test_file_revisions_append_and_download(client, auth_headers, item, tmp_path
     assert [f['revision'] for f in listing] == [2, 1]
 
     fileid = listing[1]['fileid']
-    download = client.get(f'/api/printedparts/files/{fileid}/download')
+    download = client.get(f'/api/printedparts/files/{fileid}/download', headers=auth_headers)
     assert download.status_code == 200
     assert download.data == b'solid part'
     assert 'clip_v1.stl' in download.headers['Content-Disposition']
@@ -335,7 +335,7 @@ def test_alert_role_members_receive(client, auth_headers, app, item,
                 headers=auth_headers)
     take = client.post('/api/printedparts/kiosk/take',
                        json={'itemcode': '3DP-9001',
-                             'badge': directory_employee, 'quantity': 6})
+                             'badge': directory_employee, 'quantity': 6}, headers=auth_headers)
     assert take.status_code == 200
     assert captured['to'] == ['crewone@site.test']
 
@@ -362,14 +362,14 @@ def test_gagelabtag_assigned_searched_and_kiosk_resolved(client, auth_headers):
                           headers=auth_headers).get_json()['data']
     assert len(searched) == 1
 
-    by_tag = client.get('/api/printedparts/kiosk/item/WJRP0117')
+    by_tag = client.get('/api/printedparts/kiosk/item/WJRP0117', headers=auth_headers)
     assert by_tag.status_code == 200
-    by_digits = client.get('/api/printedparts/kiosk/item/117')
+    by_digits = client.get('/api/printedparts/kiosk/item/117', headers=auth_headers)
     assert by_digits.status_code == 200
     assert by_digits.get_json()['data']['gagelabtag'] == 'WJRP0117'
 
 
-def test_kiosk_take_records_revision_from_qr(client, app, db, directory_employee):
+def test_kiosk_take_records_revision_from_qr(client, app, db, directory_employee, auth_headers):
     """A label QR payload 'TAG|rev' resolves the item by TAG and records the
     revision on the take (traceability of which print-file rev was consumed)."""
     with app.app_context():
@@ -380,7 +380,7 @@ def test_kiosk_take_records_revision_from_qr(client, app, db, directory_employee
         iid = row.printeditemid
 
     take = client.post('/api/printedparts/kiosk/take', json={
-        'itemcode': 'WJRP7000|3', 'badge': directory_employee, 'quantity': 1})
+        'itemcode': 'WJRP7000|3', 'badge': directory_employee, 'quantity': 1}, headers=auth_headers)
     assert take.status_code == 200, take.get_json()
 
     with app.app_context():
@@ -391,7 +391,7 @@ def test_kiosk_take_records_revision_from_qr(client, app, db, directory_employee
 
     # Manual entry (no |rev) records a null revision, still resolves.
     take2 = client.post('/api/printedparts/kiosk/take', json={
-        'itemcode': 'WJRP7000', 'badge': directory_employee, 'quantity': 1})
+        'itemcode': 'WJRP7000', 'badge': directory_employee, 'quantity': 1}, headers=auth_headers)
     assert take2.status_code == 200
     with app.app_context():
         last = (PrintedItemTransaction.query
@@ -400,7 +400,7 @@ def test_kiosk_take_records_revision_from_qr(client, app, db, directory_employee
         assert last.revision is None
 
 
-def test_lowstock_routes_to_support_team_webhook(client, app, db, directory_employee):
+def test_lowstock_routes_to_support_team_webhook(client, app, db, directory_employee, auth_headers):
     """A low-stock crossing posts to the selected support team's webhook URL."""
     from unittest.mock import patch
     from shopdb.core.models import SupportTeam, Setting
@@ -418,7 +418,7 @@ def test_lowstock_routes_to_support_team_webhook(client, app, db, directory_empl
     with patch('shopdb.api.send_webhook') as mock_send:
         # take 2 -> 6 crosses to 4 (<= threshold 5) -> alert fires
         resp = client.post('/api/printedparts/kiosk/take', json={
-            'itemcode': 'WJRP7100', 'badge': directory_employee, 'quantity': 2})
+            'itemcode': 'WJRP7100', 'badge': directory_employee, 'quantity': 2}, headers=auth_headers)
         assert resp.status_code == 200, resp.get_json()
         assert mock_send.called
         assert mock_send.call_args.kwargs['url'] == 'https://teams.example/3dprint'