Merge remote-tracking branch 'origin/main' into wilm

# Conflicts:
#	shopdb/__init__.py

plugins/computers/api/routes.py

@@ -17,7 +17,7 @@ computers_bp = Blueprint('computers', __name__)
 # =============================================================================
 
 @computers_bp.route('/types', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('computers.view')
 def list_computer_types():
     """List all computer types."""
     page, per_page = get_pagination_params(request)
@@ -39,7 +39,7 @@ def list_computer_types():
 
 
 @computers_bp.route('/types/<int:type_id>', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('computers.view')
 def get_computer_type(type_id: int):
     """Get a single computer type."""
     t = db.session.get(ComputerType, type_id)
@@ -55,7 +55,6 @@ def get_computer_type(type_id: int):
 
 
 @computers_bp.route('/types', methods=['POST'])
-@jwt_required()
 @require_permission('computers.create')
 def create_computer_type():
     """Create a new computer type."""
@@ -93,7 +92,6 @@ def create_computer_type():
 
 
 @computers_bp.route('/types/<int:type_id>', methods=['PUT'])
-@jwt_required()
 @require_permission('computers.edit')
 def update_computer_type(type_id: int):
     """Update a computer type."""
@@ -127,7 +125,6 @@ def update_computer_type(type_id: int):
 
 
 @computers_bp.route('/types/<int:type_id>', methods=['DELETE'])
-@jwt_required()
 @require_permission('computers.delete')
 def delete_computer_type(type_id: int):
     """Delete a computer type. Refused if any PC still uses it."""
@@ -148,7 +145,7 @@ def delete_computer_type(type_id: int):
 # =============================================================================
 
 @computers_bp.route('/protocols', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('computers.view')
 def list_protocols():
     """List access protocols. ?active=false includes disabled ones."""
     query = AccessProtocol.query
@@ -159,7 +156,6 @@ def list_protocols():
 
 
 @computers_bp.route('/protocols', methods=['POST'])
-@jwt_required()
 @require_permission('computers.edit')
 def create_protocol():
     data = request.get_json() or {}
@@ -180,7 +176,6 @@ def create_protocol():
 
 
 @computers_bp.route('/protocols/<int:protocol_id>', methods=['PUT', 'PATCH'])
-@jwt_required()
 @require_permission('computers.edit')
 def update_protocol(protocol_id):
     p = db.session.get(AccessProtocol, protocol_id)
@@ -199,7 +194,6 @@ def update_protocol(protocol_id):
 
 
 @computers_bp.route('/protocols/<int:protocol_id>', methods=['DELETE'])
-@jwt_required()
 @require_permission('computers.edit')
 def delete_protocol(protocol_id):
     p = db.session.get(AccessProtocol, protocol_id)
@@ -299,7 +293,7 @@ def _sync_access_methods(comp, data):
 # =============================================================================
 
 @computers_bp.route('/display-kiosks', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('computers.view')
 def list_display_kiosks():
     """Reporting display kiosks, for the Dashboard Defaults picker.
 
@@ -335,7 +329,7 @@ def list_display_kiosks():
 
 
 @computers_bp.route('', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('computers.view')
 def list_computers():
     """
     List all computers with filtering and pagination.
@@ -443,7 +437,7 @@ def list_computers():
 
 
 @computers_bp.route('/<int:computer_id>', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('computers.view')
 def get_computer(computer_id: int):
     """Get a single computer with full details."""
     comp = db.session.get(Computer, computer_id)
@@ -467,7 +461,7 @@ def get_computer(computer_id: int):
 
 
 @computers_bp.route('/by-asset/<int:asset_id>', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('computers.view')
 def get_computer_by_asset(asset_id: int):
     """Get computer data by asset ID."""
     comp = Computer.query.filter_by(assetid=asset_id).first()
@@ -486,7 +480,7 @@ def get_computer_by_asset(asset_id: int):
 
 
 @computers_bp.route('/by-hostname/<hostname>', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('computers.view')
 def get_computer_by_hostname(hostname: str):
     """Get computer by hostname."""
     comp = Computer.query.filter_by(hostname=hostname).first()
@@ -505,7 +499,6 @@ def get_computer_by_hostname(hostname: str):
 
 
 @computers_bp.route('', methods=['POST'])
-@jwt_required()
 @require_permission('computers.create')
 def create_computer():
     """
@@ -623,7 +616,6 @@ def create_computer():
 
 
 @computers_bp.route('/<int:computer_id>', methods=['PUT'])
-@jwt_required()
 @require_permission('computers.edit')
 def update_computer(computer_id: int):
     """Update computer (both Asset and Computer records)."""
@@ -736,7 +728,6 @@ def update_computer(computer_id: int):
 
 
 @computers_bp.route('/<int:computer_id>', methods=['DELETE'])
-@jwt_required()
 @require_permission('computers.delete')
 def delete_computer(computer_id: int):
     """Delete (soft delete) computer."""
@@ -766,7 +757,7 @@ def delete_computer(computer_id: int):
 # =============================================================================
 
 @computers_bp.route('/<int:computer_id>/apps', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('computers.view')
 def get_installed_apps(computer_id: int):
     """Get all installed applications for a computer."""
     comp = db.session.get(Computer, computer_id)
@@ -789,7 +780,6 @@ def get_installed_apps(computer_id: int):
 
 
 @computers_bp.route('/<int:computer_id>/apps', methods=['POST'])
-@jwt_required()
 @require_permission('computers.create')
 def add_installed_app(computer_id: int):
     """Add an installed application to a computer."""
@@ -846,7 +836,6 @@ def add_installed_app(computer_id: int):
 
 
 @computers_bp.route('/<int:computer_id>/apps/<int:app_id>', methods=['DELETE'])
-@jwt_required()
 @require_permission('computers.delete')
 def remove_installed_app(computer_id: int, app_id: int):
     """Remove an installed application from a computer."""
@@ -874,7 +863,6 @@ def remove_installed_app(computer_id: int, app_id: int):
 # =============================================================================
 
 @computers_bp.route('/<int:computer_id>/report', methods=['POST'])
-@jwt_required()
 @require_permission('computers.create')
 def report_status(computer_id: int):
     """
@@ -913,7 +901,7 @@ def report_status(computer_id: int):
 # =============================================================================
 
 @computers_bp.route('/dashboard/summary', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('computers.view')
 def dashboard_summary():
     """Get computer dashboard summary data."""
     # Total active computers
@@ -958,7 +946,6 @@ def dashboard_summary():
 
 
 @computers_bp.route('/dashboard/quiet', methods=['GET'])
-@jwt_required()
 @require_permission('computers.view')
 def dashboard_quiet():
     """PCs that WERE reporting, have stopped, and are still meant to be in use.
@@ -1012,7 +999,6 @@ def dashboard_quiet():
 
 
 @computers_bp.route('/dashboard/sharedmachines', methods=['GET'])
-@jwt_required()
 @require_permission('computers.view')
 def dashboard_sharedmachines():
     """Machine numbers claimed by more than one PC, with nothing filed under