Blank asset numbers, contested device claims, and honest toner forecasting

plugins/printers/api/asset_routes.py

@@ -1963,6 +1963,17 @@ def update_printer(printer_id: int):
 
     asset = printer.asset
 
+    # An UPDATE may not blank the asset number. Create validates it and the
+    # column is NOT NULL, but the conflict check below only runs when the value
+    # DIFFERS, and '' never collides with anything - so a payload carrying an
+    # empty assetnumber wrote it straight through. A form that loaded blank
+    # (a failed reference load, a partial fetch) then saved the blank over a
+    # real record.
+    if 'assetnumber' in data and not (data['assetnumber'] or '').strip():
+        return error_response(
+            ErrorCodes.VALIDATION_ERROR,
+            'assetnumber cannot be empty')
+
     # Check for conflicting assetnumber
     if 'assetnumber' in data and data['assetnumber'] != asset.assetnumber:
         if Asset.query.filter_by(assetnumber=data['assetnumber']).first():