Merge remote-tracking branch 'origin/main' into wilm

# Conflicts:
#	shopdb/__init__.py

plugins/machines/api/routes.py

@@ -17,7 +17,7 @@ machines_bp = Blueprint('machines', __name__)
 # =============================================================================
 
 @machines_bp.route('/types', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('machines.view')
 def list_machine_types():
     """List all machine types."""
     page, per_page = get_pagination_params(request)
@@ -39,7 +39,7 @@ def list_machine_types():
 
 
 @machines_bp.route('/types/<int:type_id>', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('machines.view')
 def get_machine_type(type_id: int):
     """Get a single machine type."""
     t = db.session.get(MachineType, type_id)
@@ -55,7 +55,6 @@ def get_machine_type(type_id: int):
 
 
 @machines_bp.route('/types', methods=['POST'])
-@jwt_required()
 @require_permission('machines.create')
 def create_machine_type():
     """Create a new machine type."""
@@ -92,7 +91,6 @@ def create_machine_type():
 
 
 @machines_bp.route('/types/<int:type_id>', methods=['PUT'])
-@jwt_required()
 @require_permission('machines.edit')
 def update_machine_type(type_id: int):
     """Update a machine type."""
@@ -126,7 +124,6 @@ def update_machine_type(type_id: int):
 
 
 @machines_bp.route('/types/<int:type_id>', methods=['DELETE'])
-@jwt_required()
 @require_permission('machines.delete')
 def delete_machine_type(type_id: int):
     """Delete a machine type. Refused if any asset still uses it."""
@@ -147,7 +144,7 @@ def delete_machine_type(type_id: int):
 # =============================================================================
 
 @machines_bp.route('', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('machines.view')
 def list_machines():
     """
     List all machines with filtering and pagination.
@@ -284,7 +281,7 @@ def _dualpath_partner_for(assetid):
 
 
 @machines_bp.route('/<int:machine_id>', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('machines.view')
 def get_machine(machine_id: int):
     """Get a single machine item with full details."""
     mach = db.session.get(Machine, machine_id)
@@ -304,7 +301,7 @@ def get_machine(machine_id: int):
 
 
 @machines_bp.route('/by-asset/<int:asset_id>', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('machines.view')
 def get_machine_by_asset(asset_id: int):
     """Get machine data by asset ID."""
     mach = Machine.query.filter_by(assetid=asset_id).first()
@@ -324,7 +321,6 @@ def get_machine_by_asset(asset_id: int):
 
 
 @machines_bp.route('', methods=['POST'])
-@jwt_required()
 @require_permission('machines.create')
 def create_machine():
     """
@@ -418,7 +414,6 @@ def create_machine():
 
 
 @machines_bp.route('/<int:machine_id>', methods=['PUT'])
-@jwt_required()
 @require_permission('machines.edit')
 def update_machine(machine_id: int):
     """Update machine (both Asset and Machine records)."""
@@ -501,7 +496,6 @@ def update_machine(machine_id: int):
 
 
 @machines_bp.route('/<int:machine_id>', methods=['DELETE'])
-@jwt_required()
 @require_permission('machines.delete')
 def delete_machine(machine_id: int):
     """Delete (soft delete) machine."""
@@ -531,7 +525,7 @@ def delete_machine(machine_id: int):
 # =============================================================================
 
 @machines_bp.route('/dashboard/summary', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('machines.view')
 def dashboard_summary():
     """Get machine dashboard summary data."""
     # Dualpath single-machine collapse: hide the secondary bay from counts so a
@@ -578,7 +572,6 @@ def dashboard_summary():
 
 
 @machines_bp.route('/dashboard/outofservice', methods=['GET'])
-@jwt_required()
 @require_permission('machines.view')
 def dashboard_outofservice():
     """Machines whose status says they are not running.

plugins/machines/plugin.py

@@ -231,7 +231,9 @@ class MachinesPlugin(BasePlugin):
                 'name': 'Machines',
                 'icon': 'cog',
                 'route': '/machines',
+                'permission': 'machines.view',
                 'position': 10,
+                'section': 'assets',
             },
         ]