The API URL hint still showed the old device.warranty path; align it with the
corrected sbil/eapi/v5 endpoint the provider now defaults to.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- DellProvider: real Dell TechDirect lookup. OAuth2 via HTTP Basic auth,
asset-entitlements under /PROD/sbil/eapi/v5 (the device.warranty path 404s
for this account), map latest dated entitlement to service level + dates.
Cache the token process-wide; Dell rate-limits the token endpoint and a
fresh request per refresh trips a 401 cooldown. Verified against live Dell.
- Lenovo/HP stay config-shaped stubs.
- Settings: warranty_dell_* keys (category integrations); Dell Warranty Lookup
block in System Settings > Integrations (enable + client id/secret masked +
optional token/API URL overrides).
- WarrantyPanel takes optional pre-fetched items; PCDetail fetches once and
feeds both the panel and a new hero warranty-status/end-date badge.
- tools/mock_dell.py for offline testing of the provider flow.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Feature work from the 2026-07 session:
Settings IA
- Replace the flat 27-card settings hub with a persistent two-pane shell
(SettingsLayout.vue): grouped, searchable left rail + content pane.
- Nest all settings/* routes under the shell via router post-processing;
shared nav catalog in settingsNav.js. Group by asset class (PCs, Printers,
Equipment, Network) so per-type settings stop scattering.
Custom fields (core)
- customfields + customfieldvalues tables (migration 7d14), CRUD API at
/api/customfields, per-asset value get/save.
- Settings management page + reusable CustomFieldsSection (detail) and
CustomFieldsInputs (form) wired into all four asset types.
Warranty (new plugin)
- plugins/warranty: warranties + warrantyassets (migration 7d15), derived
coverage status, provider abstraction (manual now; Dell/Lenovo/HP stubs).
- API CRUD + per-asset panel + report buckets; WarrantyPanel on all four
detail pages; Warranties management page; Warranty report + Reports card.
- Seed warranty.* permissions.
Printer drivers
- printerdrivers table (migration 7d13) linked to printer models; drivers now
surface on the matching printer's detail page.
Other
- PCDetail rebalanced (Network + Status + Warranty + custom fields on the right).
- Rename PCs list "Features" column to "Remote Access"; fix badge hover underline.
- Drop equipment islocationonly field.
- Centralize asset-type label/route maps into utils/assetTypes.js.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The settings index showed all 6 groups stacked (still a long scroll). Switch it
to the same pattern as System Settings: a left group-tab nav showing one group's
cards at a time, plus a search box that flattens to matching cards across all
groups. Same group data, no routes changed.
Frontend-only. Build + naming green, verified.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
System Settings had grown to one long scroll (Integrations, Email, Audit,
Authentication, Asset Identifiers, Global Search, PC Type Mapping). Now a
vertical tab nav shows one section at a time, plus a search box that filters the
tabs by label/keywords (and shows every matching section while searching). Type
"toner" -> Integrations, "fqdn" -> Asset Identifiers, etc.
Frontend-only, behavior of each section unchanged. Build + naming green, verified.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The settings index had grown to 16 flat cards with no organization. Group them
into purpose-based sections (Asset Reference Data, Locations & Organization,
Network, Displays & Kiosks, System, Access & Audit) so it stays scannable as it
grows. Cards are now data-driven (one group list) instead of repeated markup;
all existing routes/cards preserved.
Frontend-only. Build + naming green.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Classic feature gap: a shopfloor/lobby kiosk auto-selects which business unit to
show based on the display PC's IP (classic dashboarddefaults table +
apivisitorlocation.asp). For the main admin dashboard this does nothing - it is
kiosk/visitor-display infra.
- Model: DashboardDefault (dashboarddefaults: ipaddress unique, businessunitid
FK, description). Migration 7d01_dashboarddefaults (head).
- API (core, /api/dashboarddefaults): CRUD + GET /visitor-location that resolves
the calling display's business unit from its IP (X-Forwarded-For/remote_addr,
or explicit ?ipaddress=); unmapped IP returns a null businessunitid, not an
error. Unauthenticated resolve (kiosks); writes are admin.
- Frontend: ShopfloorDashboard auto-selects its business unit via visitor-location
on load when none is chosen; Settings > Dashboard Defaults CRUD page +
dashboardDefaultsApi client.
Tests: create + resolve by IP -> BU; unmapped IP -> null; duplicate IP 409.
191 tests pass, naming green, app boots, endpoint + admin page verified live.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Shopfloor 2.0 PCs can't run unsigned .bat printer maps, so the signed printer
installer EXE pulls printer data + floor-map positions from the API and renders
the picker itself. Adds the endpoint the EXE consumes.
GET /api/printers/install-list - flat, unpaginated list of NETWORK printers
(USB-only excluded), each with: printerid, name, machinenumber, windowsname,
sharename, hostname, ipaddress, vendorname, modelnumber, installpath, iscsf,
locationname, mapx, mapy. Replaces the classic apiprinters.asp contract and
adds the map position (mapx/mapy) the EXE needs.
Tests: network printer appears with map position + installer fields; USB-only
printer excluded. 188 tests pass, naming green.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Extends the computers collector so it can replace the classic api.asp
updateCompleteAsset path that the shopfloor PC fleet uses to auto-update data.
Collector schema (project naming) now accepts the GE-Enforce/enrollment shape:
machinenumber, pctype, pcsubtype, serialnumber, loggedinuser, lastboottime,
lastcheckin, ipaddress, vendorname, modelnumber, osname, installedsoftware.
- machinenumber -> Asset.assetnumber (skips the 9999 imaging placeholder, falls
back to hostname), on create and update.
- pctype -> ComputerType via a configurable mapping (see below).
- vendor/model created if missing (free vocab); OS looked up (controlled, warns
if unknown); pcsubtype accepted but not yet stored (warning).
- Dropped per scope: VNC/WinRM flags, warranty, DNC config, multi-NIC.
Configurable pc-type mapping (the gea-shopfloor-* imaging taxonomy ->
ComputerType): defaults + resolution live in plugins/computers/pctypemap.py
(plugin domain, contract-pure - reads Setting via shopdb.api); overrides stored
as pctypemap_<pxetype> settings, seeded on plugin install, edited in Settings >
System > "Collector PC Type Mapping" (new UI section).
Migration doc: docs/COLLECTOR-INTEGRATION.md maps classic api.asp fields +
GE-Enforce status fields to the collector schema, documents machine-number
sourcing (registry MachineNo first, then C:\Enrollment\machine-number.txt) and
that the transport is interim.
Tests: complete-asset payload maps machinenumber/pctype/vendor/model/os; 9999
placeholder falls back to hostname. 186 tests pass, naming green, app boots,
mapping UI verified.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Third core feature pulled into a plugin (blueprint-only, like slides). The
employee directory is a read-only lookup over a separate HR database.
- plugins/employees/: manifest (api_prefix /api/employees, no deps), api/ (moved
blueprint, contract-pure: success/error/ErrorCodes + employee_connection all
from shopdb.api), plugin.py (get_blueprint, get_models -> []).
- employee_connection STAYS core infrastructure in shopdb.api (config-driven
external DB connector, shared by search + the notifications shopfloor feed). So
no get_services needed and no contract change - the plugin owns the directory
FEATURE, core owns the shared connector.
- Fixed a latent bug in the move: error paths used ErrorCodes.DATABASE_ERROR
which does not exist -> ErrorCodes.INTERNAL_ERROR (so a directory outage now
returns a clean 500 envelope instead of an AttributeError crash).
- De-cored: deleted shopdb/core/api/employees.py, removed from
CORE_BLUEPRINT_NAMES + core/api/__init__ import/__all__. Registered in
instance/plugins.json.
Pinned first: validation (400) + graceful-degrade (500) characterization tests;
the degrade test caught the DATABASE_ERROR bug and goes green with the fix.
184 tests pass, naming green, app boots 9 bundled plugins, endpoint verified live.
Plugin extractions complete: knowledgebase, slides, employees.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Second core feature pulled into a plugin. Slides is the minimal plugin shape:
a blueprint only - no model, no AssetType, no nav (it is purely an API surface
consumed by the TV dashboard).
- plugins/slides/: manifest (api_prefix /api/slides, no deps), api/ (moved
blueprint, contract-pure imports via shopdb.api, same /api/slides route so the
TV dashboard is unchanged), plugin.py (get_blueprint, get_models -> []).
- Fixed a latent bug in the move: error path used ErrorCodes.SERVER_ERROR which
does not exist -> ErrorCodes.INTERNAL_ERROR.
- De-cored: deleted shopdb/core/api/slides.py, removed from CORE_BLUEPRINT_NAMES
+ core/api/__init__ import/__all__. Registered in instance/plugins.json.
Pinned with a characterization test first; passes unchanged against the plugin
blueprint. 174 tests pass, naming green, app boots 8 bundled plugins, /api/slides
verified live.
Note: the shopfloor dashboard is NOT extractable - it is a frontend-only Vue view
aggregating the businessunits + notifications APIs, with no backend to move and no
frontend plugin system.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Lets an admin choose which content types appear in global search results,
independent of whether the owning plugin is enabled (the existing
_require_enabled gating was all-or-nothing per plugin).
- settings.py: SEARCH_DOMAINS const (9 result types: application, knowledgebase,
employee, equipment, computer, printer, network_device, notification, subnet)
+ seed keys search_<type>_enabled (boolean, default true) in
build_default_settings (covers API seed + CLI).
- search.py: global_search loads disabled types in one query (category 'search')
and filters the deduped results by type before counts/truncation. Missing key
= enabled.
- SystemSettings.vue: "Global Search" section, one toggle per domain (mirrors the
identifier pattern; create-on-404 fallback so an un-reseeded deploy still works).
- Tests: domain included by default, disabled domain excluded, seed creates the
9 keys.
166 tests pass, naming green, build green. Verified live: toggling
search_knowledgebase_enabled off drops knowledgebase from search counts and back
on restores it. Dev DB seeded (9 keys).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
First feature extracted from core into a plugin per "plugin is the product",
mirroring the notifications plugin. KB is a NON-asset plugin: it contributes a
model + blueprint + nav item but registers no AssetType.
- plugins/knowledgebase/: manifest.json (api_prefix /api/knowledgebase, no deps),
models/ (KnowledgeBase, contract-pure imports via shopdb.api), api/ (the
blueprint, same routes/prefix so the frontend is unchanged), plugin.py
(get_blueprint + get_models + get_navigation_items).
- De-cored: removed shopdb/core/models/knowledgebase.py + api/knowledgebase.py,
their __init__ exports, and 'knowledgebase' from CORE_BLUEPRINT_NAMES; dropped
the hardcoded KB nav item from dashboard.py (now via the plugin nav hook).
- search.py and reports.py lazy-import KnowledgeBase from the plugin and degrade
gracefully (search skips via _require_enabled when disabled; kb-popularity
report returns 503 if the plugin is absent).
- Registered in instance/plugins.json (enabled).
The knowledgebase table stays in the core Alembic chain (bundled-plugin schema
folded into core, ADR-004); the model just maps it. KB was never in the
shopdb.api contract surface, so no __contract_version__ bump.
Pinned with characterization tests first (test_knowledgebase.py); they pass
unchanged against the plugin blueprint. 163 tests pass, naming green, app boots
7 bundled plugins, KB endpoint/nav/search verified live.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Verification audit (re-run of the 6 skill lenses) confirmed the prior fixes hold
and surfaced a few misses:
Security (HIGH):
- search.py _check_smart_redirect still opened a raw pymysql connection with
root/rootpassword (reachable on any 9-digit SSO query). Now uses the shared
env-backed employee_connection helper.
- Deleted dead shopdb/core/services/employee_service.py (zero importers; carried
another root/rootpassword literal). No hardcoded credentials remain in app
logic; config.py dev defaults stay gated by ProductionConfig.validate.
Dead hook:
- get_services was implemented by the printers plugin but had no consumer (docs
claimed otherwise). Added PluginManager.get_service(name) that resolves a
service from enabled plugins; updated PLUGIN-HOOKS.md.
Tests:
- search disabled-plugin exclusion (the high-value gap): enabled plugin's
hostname appears, disabled plugin's hostname drops out (searched by a hostname
distinct from assetnumber so only the gated domain can match).
- get_service consumer test (unknown name -> None).
Simplify:
- Extract the triplicated GE_LOGO_SVG + loadLogo + drawLogoOverlay into shared
frontend/src/views/print/qrLogo.js (renderQrDataUrl); both QR views use it.
- applications.py: lift the misplaced pagination import to the top; drop unused
Computer unpacking in the 3 endpoints that only touch ComputerInstalledApp.
154 tests pass, naming/style green, app boots, QR render verified.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- USBLabelBatch.vue: recolor controls/selection/cell borders to the app CSS
variables (was hardcoded #667eea/#28a745/#dc3545) and add
`print-color-adjust: exact` so barcodes print even with "Background graphics"
off. (Barcodes render as vector SVG, so no canvas->img change needed.)
- ADR-004: document the resolved migration strategy - single core Alembic chain
(`flask db upgrade`), bundled plugin schema folded into core (7c04), resolving
the Phase 7B per-plugin-chain conflict footgun. External plugins may still
ship their own chains.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Architectural pass from the skill review ("plugin is the product" boundary).
Core no longer imports plugin models at module load (was a hard import-time
dependency that broke core if the computers plugin was absent/disabled):
- collector.py, applications.py, reports.py: lazy + guarded imports of the
computers plugin models. Endpoints that need install-tracking now return 503
when the plugin is absent instead of failing at import.
Search honors runtime enable/disable:
- search.py: _require_enabled(name) raises ImportError for a disabled plugin,
so each plugin-scoped block skips it (a disabled plugin's rows leave search).
- Replace hardcoded root/rootpassword employee-DB connection in _search_employees
with the shared env-backed employee_connection helper.
Plugin hooks (integrating-plugin-hooks: every hook needs a consumer):
- get_dashboard_widgets: add the consumer GET /api/dashboard/widgets (5 plugins
already implemented the hook; it had none). Skips disabled, isolates in prod.
- get_searchable_fields: REMOVED. Zero plugins implemented it and there was no
consumer; global search is a core concern over the asset model. Contract
reduction, __contract_version__ 0.3.0 -> 0.4.0.
Docs/contract: PLUGIN-HOOKS.md (widgets consumer note, searchable-fields removal,
0.4.0), PLUGIN-QUICKSTART.md, ADR-001 hook list. Tests: widgets endpoint
aggregate + disabled-skip; contract tests for the removed/added hooks.
151 tests pass, naming/style green, app boots all 6 plugins.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
QR codes were drawn to live <canvas> elements, which print unreliably (often
blank in the printout). The print pages also used hardcoded off-brand colors
(#667eea indigo) instead of the app's palette.
- PrinterQRBatch.vue + PrinterQRSingle.vue: render each QR (with the GE
monogram composited in) to a data-URL <img> instead of a live <canvas>.
Images print every time.
- Add `print-color-adjust: exact` so the browser prints the QR images and
borders even when the user's "Background graphics" option is off.
- Cache the GE logo image once instead of reloading it per code.
- Recolor controls/buttons/selection/label borders to the app CSS variables
(--primary, --success, --danger, --bg-card, --text...), so the pages match
the scheme and adapt to dark mode. Printed labels stay black-on-white.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The identifier-flags composable fetched settings once and cached them in a
module singleton, so toggling an identifier in Settings (gauge/maintenance/FQDN
per asset type) did not take effect on already-open asset views until a full
page reload. Disabled identifiers kept showing.
- identifierSettings.js: extract applySetting/fetchFlags; export
reloadIdentifierFlags() and setIdentifierFlag(name, assettype, enabled) to
mutate the shared reactive state.
- SystemSettings.vue: push each successful matrix toggle into the shared state
via setIdentifierFlag so dependent views react immediately.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Addresses findings from a 6-lens review against the project skills
(defining-asset-contract, enforcing-plugin-contract, hardening-flask-config,
integrating-plugin-hooks, pinning-flask-behavior, simplifying-python).
Security (hardening-flask-config):
- Load per-plugin COLLECTOR_API_KEY_<PLUGIN> from env in create_app. from_object
only copies class attributes, so per-plugin keys (ADR-006) were dead in real
deploys and silently fell back to the shared key.
- EMPLOYEE_DB_USER/PASSWORD no longer default to root/rootpassword (no safe
default for a secret; unset fails loud). Documented in .env.example + DEPLOY.md.
- COLLECTOR_API_KEY + per-plugin + EMPLOYEE_DB_* added to .env.example/DEPLOY.md.
Hook isolation (integrating-plugin-hooks):
- collector _collector_plugins and dashboard get_navigation now re-raise in
dev/test and log+isolate in prod, instead of silently swallowing a broken
plugin hook.
Plugin loader (enforcing-plugin-contract):
- enable_plugin/install_plugin read dependencies+version from the manifest
instead of instantiating the plugin class.
- _register_plugin_components rejects a second plugin claiming an already-used
api_prefix (reset per app in init_app).
Tests (pinning-flask-behavior):
- test_identifiers.py: gauge/maintenance round-trip on computer/printer/network
create+update; per-type seed yields the 12 identifier keys.
- contract tests for apply_collector_payload presence + schema-declarers-implement.
- security tests for per-plugin key env loading + no employee-db password default.
Docs/contract sync (defining-asset-contract):
- PLUGIN-HOOKS.md documents apply_collector_payload; stale 0.2.0 -> 0.3.0.
- ADR-006 documents apply_collector_payload + single-dispatch rationale.
- ADR-001 enumerates the expanded shopdb.api import surface.
Simplify (simplifying-python):
- De-duplicate the 21-entry settings defaults: shared build_default_settings()
used by both the /settings/seed route and the CLI (were drifting copies).
- Remove dead AssetStatus import + redundant AssetType local import in computers
plugin; comment the statusid=1 collector default.
153 tests pass (was 145), naming/style green.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Plugins were reaching into internal core paths (shopdb.core.models.*,
shopdb.extensions, shopdb.utils.*), coupling them to core's file layout and
violating the ADR-001 contract. Consolidate onto one versioned surface.
- shopdb.api: expand from 2 helpers to the full plugin import surface -
db, cache; BaseModel, AuditMixin; core models (Asset, AssetType,
AssetStatus, Vendor, Model, Communication, CommunicationType, Location,
Setting, AuditLog, Application, AppVersion, OperatingSystem); response +
pagination helpers; employee_connection. Documented in PLUGIN-HOOKS.md.
- Migrate all 22 plugin source files to import only from shopdb.api (plus
shopdb.plugins.base for the ABC).
- Drop the printers plugin's legacy MachineType dependency: remove
_ensure_legacy_machine_types and the seed_supplies machinetypeid lookup
(Model.machinetypeid is nullable; printers carry type via PrinterType).
- Guard test test_plugins_only_import_contract_surface scans plugin source
and fails on any core import outside shopdb.api / shopdb.plugins.base.
- Scaffold templates updated so generated plugins are contract-pure.
- Bump __contract_version__ 0.2.0 -> 0.3.0 (additive surface expansion;
manifests pin <1.0.0 so they still satisfy).
145 tests pass, naming/style green, app factory boots all 6 plugins.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Optional asset identifiers (gauge lab reference, maintenance reference, FQDN)
were global per-identifier and only surfaced on equipment. Now they are
toggleable per asset type and rendered on every asset type.
- settings: replace 3 global identifier toggles with a per-type matrix. New
keys identifier_<name>_<assettype>_enabled (3 identifiers x 4 types).
IDENTIFIER_LABELS / IDENTIFIER_ASSETTYPES constants drive the seed (API seed
and CLI seed settings).
- composable: identifierSettings now exposes isEnabled(name, assettype),
per-type flag winning over the legacy global key, defaulting on.
- backend writes: computers, network, printers asset create + update now
accept gaugelabreference and maintenancereference (equipment already did).
Reads already flowed through Asset.to_dict.
- frontend: Settings page renders an identifier x asset-type toggle matrix.
Equipment, PC, printer, network forms and detail pages show gauge/maintenance
(and FQDN where applicable) gated by isEnabled(name, type).
Legacy global identifier_<name>_enabled keys are still honored as a fallback
for older installs. SystemSettings toggles upsert (create on 404) so a deploy
that has not re-seeded still works on first toggle.
144 tests pass, naming/style check green, frontend builds. Verified live:
matrix renders, PC form shows the fields, PUT persists gauge/maintenance on a
PC and reads back.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Implements the plugin collector contract from ADR-006 so any plugin can
accept idempotent inventory ingest, not just PCs.
- base.py: add apply_collector_payload hook (companion to get_collector_schema),
raises NotImplementedError by default for plugins that declare a schema but
do not implement the upsert.
- collector.py: generic POST /api/collector/<plugin> dispatch with per-plugin
API key (COLLECTOR_API_KEY_<PLUGINNAME> with COLLECTOR_API_KEY fallback),
schema-driven identity validation, idempotent upsert, ADR-006 response
contract (status, action, assetid, identityvalue, warnings), audit log.
JWT-protected GET /api/collector/_schemas lists registered schemas. Legacy
/pc, /apps, /heartbeat, /bulk kept for back-compat.
- computers plugin: implements get_collector_schema (identityfield hostname)
and apply_collector_payload (create-or-update Asset+Computer, serialnumber,
loggedinuser, lastboottime, primary IP communication, installed apps).
- tests: 7 collector-contract tests (auth, 404, validation, create/idempotent
update, per-plugin key precedence, JWT schema listing).
A single dynamic dispatch route is used instead of per-plugin blueprint
registration, avoiding Flask's register-blueprint-after-first-request error.
144 tests pass, naming/style check green.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
enable_plugin called register_blueprint at runtime, which Flask forbids after
the first request (AssertionError -> 500). Enabling now flips the registry flag
and fires on_enable best-effort; routes register on the next restart, symmetric
with disable. Nav reflects the re-enable immediately.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The nav endpoint now skips disabled plugins (checks the registry), so disabling
a plugin removes it from the menu right away without a restart. Its API routes
remain registered until the next restart (Flask cannot unregister a blueprint
at runtime), but users no longer see links to it.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
GET /api/plugins now lists all discovered plugins (enabled or not) with status;
PUT /api/plugins/<name> toggles enabled (persists to plugins.json). New
Settings > Plugins admin page with per-plugin toggles. Route changes apply on
next restart. Replaces CLI-only enable/disable for self-serve admin.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The core chain already owns and reproduces the full bundled schema (deploys run
`flask db upgrade` only). The per-plugin Alembic baselines duplicated those
tables, so `flask plugin upgrade-all` would conflict - a footgun. Remove the 6
bundled plugin migration dirs; the per-plugin Alembic helpers
(alembic_template, PluginMigrationRunner) remain for external/filesystem
plugins. upgrade-all now cleanly no-ops for bundled plugins.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- PluginMeta.core_version defaulted to >=1.0.0, which would reject the current
0.2.0 framework for any plugin relying on the default. Set to >=0.2.0,<1.0.0.
- Add GET /api/plugins introspection: lists loaded plugins (name, version,
core_version, api_prefix, dependencies) + the framework contract version.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Backends read snake_case filter params (type_id, vendor_id, location_id,
businessunit_id, status_id, os_id) while the frontend sends the concatenated
form (typeid, vendorid, ...), so the network/notifications/printers list
filters silently did nothing. Backends now read the concatenated name with a
snake_case fallback (no breakage), matching the locked naming convention.
Verified: network type filter now narrows results (45 -> 25 for Access Points).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
On a new PC, the PC Number (assetnumber) auto-fills from the serial number as
it is typed, but stops auto-filling once the user edits it manually. Edit mode
never auto-overwrites.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
PCs are identified by hostname (the primary identifier) with serial as the
fallback; the assetnumber is seeded from hostname rather than a separate
"PC Number" field. PC list shows Hostname/Serial (Asset Tag column removed),
PC detail title leads with hostname.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Deploys run `flask db upgrade` (core chain) only. The core chain reproduced
everything except modelsupplies + the computer make/model and installed-app
version columns, which lived only in per-plugin migrations the deploy never
runs. Migration 7c04 folds those into the core chain (idempotent).
Verified: a fresh `flask db upgrade` on an empty database produces a schema
identical to the live DB (zero table/column diffs). Also dropped two unused
appversions audit columns (create_all drift) and the empty orphaned
alembic_version_* plugin tracker tables so live matches a fresh deploy exactly.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- New locationtypes lookup (LocationType model) seeded with section, cell,
subcell, operation, meetingroom, lab, office, storage, hallway,
networkcloset, building.
- locations gains locationtypeid + parentlocationid (self-FK) for the site
location tree. Migration 7c03; cli reference-data seeds the types.
- GET /api/locations/types; locations CRUD accepts type + parent; list/detail
return locationtypename + parentlocationname.
- Locations settings page: Type column + Type/Parent selectors in the modal.
Realizes the operation-as-Location model (operations are locations with
locationtypeid='operation').
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Add applications.isrequired (model + migration 7c02 + create/update + form
checkbox). The software-compliance report compared required apps against
installs but no such flag existed, so it 500'd; now it works.
- Repair relationshiptypes rows with 0000-00-00 createddate/modifieddate
(partof/connectedto) to real timestamps.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The asset/computer model is now the single source of truth. Remove the Machine
instance layer end to end:
- Delete models Machine, MachineStatus, PCType, MachineRelationship,
InstalledApp, PrinterData; keep MachineType (models.machinetypeid still
references it).
- Delete the /api/machines, /api/statuses, /api/pctypes blueprints and the
legacy /api/printers/legacy (PrinterData) blueprint.
- Drop the deprecated communications.machineid column and its FK.
- Migration 7c01 drops tables machines, machinestatuses, pctypes,
machinerelationships, installedapps, printerdata (idempotent).
- Fix remaining readers (applications install counts) to ComputerInstalledApp.
- Frontend: remove dead machinesApi/statusesApi/pctypesApi wrappers; repoint
the PC Types settings page at computer types.
143 tests pass; all asset/computer/dashboard/report/collector endpoints 200.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- applications.py installed-on + per-computer install/uninstall/update endpoints
now use Computer / ComputerInstalledApp instead of Machine / InstalledApp.
- ApplicationDetail "Installed On" list reads the computer shape.
- Drop the unused Machine/MachineType import from the assets map endpoint.
No active core endpoint uses the Machine model anymore (only the legacy
/api/machines blueprint and reference-data seeder remain).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Add /api/assets/relationshiptypes (GET/POST) serving RelationshipType; point
relationshipTypesApi at it instead of the legacy /api/machines blueprint.
- Dashboard recent-devices widget reads assetsApi.list (asset shape) instead
of machinesApi.
No frontend code references machinesApi anymore.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Dashboard counts assets by type/status (Asset/AssetType/AssetStatus); adds
a printer count to the totals.
- Software-compliance and pc-relationships reports query Computer /
ComputerInstalledApp / assetrelationships instead of Machine.
Removes the dashboard + reports read dependency on the Machine model. (The
software-compliance report has a separate pre-existing bug: Application has no
isrequired field, so it errors before the query runs - unrelated to this change.)
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Last form still reading /api/statuses (MachineStatus); repoint to
assetsApi.statuses so its status dropdown matches the rest of the app.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- PCForm saves/loads via computersApi (asset core + computer extension +
primary IP in one call); PC Type now uses the dedicated computertypes table
instead of MachineType, fixing the cross-table id mismatch.
- Collector (/api/collector/*) writes the Computer model: lookup by hostname
or asset number, update loggedinuser/lastreporteddate/lastboottime + asset
serial, installed apps via ComputerInstalledApp.
- Add computers.vendorid + modelnumberid (PCs carry make/model) and
computerinstalledapps.installedversion; computer GET now includes
communications. Wire COLLECTOR_API_KEY into config.
Retires the last write paths to the Machine model for PCs (ADR-001).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- GET /settings now masks password/token values (were returned in plaintext
to anonymous callers); sending the mask back on update is a no-op so the
real secret is never clobbered.
- Move the employee-directory DB credentials out of source into env-backed
config (shopdb.utils.employee_db); employees + notification recognition use
the shared helper. Employee lookups stop leaking exception strings.
- Fix low-supplies report using loc.location instead of loc.locationname.
Employee/notification read endpoints stay unauthenticated by design (public
shopfloor kiosk displays consume them).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Printers save through the asset blueprint (PUT /printers) instead of the
legacy machines API; restrict supply-model picker to printer models.
- Asset statuses get full CRUD (PUT/DELETE with in-use guard); canonical set.
- Printer types reseeded to a real classification set + list filter.
- Equipment accepts gauge/maintenance references.
- Fix network list emitting network_device instead of networkdevice (View 404).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Dedicated assets.gaugelabreference and assets.maintenancereference columns
(distinct from assetnumber), surfaced on equipment. Add global per-identifier
enable/disable settings (gauge/maintenance/FQDN) read via a shared composable
and toggled in System Settings.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Rewrite the printer Zabbix integration (Bearer auth, host-by-IP, tag-based
supply lookup, ping) and replace the hardcoded toner table with a
modelsupplies table + CRUD + seed. Add mock Zabbix server, live test
harness, and the Playwright screenshot tooling.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
MySQL's default collation (utf8mb4_general_ci) is case-insensitive, so
`WHERE relationshiptype = 'controls'` matched a legacy `Controls` row.
The check skipped the insert of the lowercase ADR-001 type, then the
follow-up UPDATE accidentally wired propagatesthroughid onto the legacy
capitalized row instead of the new canonical one.
Surfaced in live dev DB after running `flask db upgrade`:
- partof, connectedto inserted correctly
- controls NOT inserted (collision with legacy `Controls`)
- legacy `Controls` row got propagation FK wired by mistake
Fix uses BINARY comparison on MySQL in both paths:
- migrations/versions/7a01_adr001_position_contract.py: dialect-aware
_eq() helper wraps each WHERE clause in BINARY when on MySQL. SQLite
and PostgreSQL stay case-sensitive by default; the plain comparison
is safe there.
- shopdb/cli/__init__.py: same dialect-aware _lookup_binary() using
func.binary() in the SQLAlchemy query.
Dev DB healed manually by renaming `Controls` -> `controls` and wiring
propagatesthroughid to partof. Other deployments that ran the buggy
migration need the same one-line UPDATE:
UPDATE relationshiptypes
SET relationshiptype = 'controls', propagatesthroughid = <partof_id>
WHERE relationshiptype = 'Controls';
(only if the deployment had a legacy capitalized row; fresh DBs are fine).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Each of the six bundled plugins (computers, equipment, network,
notifications, printers, usb) now has its own Alembic chain with a
baseline migration. Sister sites adopting one of these plugins can
manage its schema via `flask plugin migrate <name>` instead of relying
on db.create_all to bootstrap everything.
Existing single-site deploys that bootstrap via db.create_all continue
to work unchanged. The chains coexist; the bootstrap path stays the
operator's choice.
Framework
- shopdb/plugins/alembic_template.py: shared env.py logic + helpers.
PLUGIN_TABLE_OWNERS pins which tables belong to which plugin (explicit
registry, not import-side-effect). _get_plugin_metadata filters
db.metadata to only the named plugin's tables. create_plugin_tables /
drop_plugin_tables emit DDL via SQLAlchemy CreateTable so the table
definitions stay sourced from the models, not duplicated.
- shopdb/plugins/__init__.py: PluginManager.upgrade_all_plugins() runs
pending migrations across every discovered plugin and returns a status
dict. Idempotent (Alembic skips applied revisions).
CLI
- `flask plugin upgrade-all` runs pending migrations for every plugin.
Used on a fresh deploy after the core schema is in place.
Per-plugin scaffolding
- plugins/{computers,equipment,network,notifications,printers,usb}/
migrations/{alembic.ini, env.py, script.py.mako, versions/0001_baseline.py}
- Each env.py is a 5-line shim that sets PLUGIN_NAME and delegates to
the shared template. Each 0001_baseline calls create_plugin_tables(name)
/ drop_plugin_tables(name); no duplication of column definitions.
Tests
- tests/test_plugin_migrations.py (18 cases): every bundled plugin has
an entry in PLUGIN_TABLE_OWNERS, has the on-disk Alembic scaffolding,
and the filtered MetaData contains every owned table (catches drift
between the template's table list and what the models declare).
- 129 tests pass.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Lock the position-resolution columns from ADR-001 in code so
resolve_asset_position's relationship walk activates.
Schema
- Asset.mapleft -> Asset.mapx, Asset.maptop -> Asset.mapy
- Location.mapx / Location.mapy added (fallback for priority 3 of the
ADR-001 resolution chain)
- AssetRelationship.label (free-text nuance per ADR-001)
- AssetRelationship.inheritsposition (bool, server_default true, controls
whether the resolved-position walk follows the edge)
- RelationshipType.propagatesthroughid (self-FK; sibling-propagation rail)
Seeds
- Three canonical ADR-001 relationship types created idempotently:
partof, controls, connectedto
- controls.propagatesthroughid wired to partof (partof + connectedto stay
null per ADR-001 table). Both via Alembic migration AND CLI seed command
so a fresh test fixture and a sister-site deploy both end up correct.
- Legacy connection types (Serial Cable, Direct Ethernet, USB, WiFi,
Dualpath) retained for backward compat with pre-1.0 relationship rows.
Resolver
- shopdb.api.resolve_asset_position now walks inheritsposition=true edges
of type partof (then controls), recursively, depth-capped at 3 with
visited-set cycle protection. Inactive edges + non-inheritable types
are skipped. Falls through to the existing location fallback when the
walk yields nothing.
Tests
- 11 new test_api_namespace cases cover: partof walk, controls-after-
partof ordering, connectedto skipped, inheritsposition=false skipped,
recursion, cycle break, depth-3 cap, self-beats-related, related-beats-
location, inactive-edge skip.
- 111 tests pass. Naming/style check green.
Migration
- migrations/versions/7a01_adr001_position_contract.py:
- alter_column renames on assets (no data loss)
- add_column on locations + relationshiptypes + assetrelationships
- idempotent seed of three ADR types + propagation FK wire-up
- downgrade reverses + best-effort deletion of seeded types that have
no FK refs
Backend rename (mapleft/maptop -> mapx/mapy)
- shopdb/core/api/assets.py
- plugins/{computers,equipment,network,printers}/api/...
- scripts/migration/migrate_assets.py
- Legacy Machine model + machines API + import_from_mysql.py UNCHANGED
(per ADR-001 Machine retires; not part of the asset contract)
Frontend rename
- frontend/src/components/ShopFloorMap.vue
- frontend/src/views/{MapEditor.vue, pcs/{PCDetail,PCForm}.vue,
printers/{PrinterDetail,PrinterForm}.vue,
machines/{MachineDetail,MachineForm}.vue,
network/NetworkDeviceForm.vue}
- Form field labels + v-model bindings + computed flags switched in
lockstep with the backend.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
End-of-pipeline cleanup. No structural changes; documents what is
done, what is left, and the discipline for future cleanup commits.
Skill:
- simplifying-python: end-of-session cleanup discipline. Inspired by
Anthropic's open-sourced code-simplifier. Targets duplication, dead
code, voodoo constants, stale comments, misnamed identifiers,
unnecessary abstraction. Anti-targets: architecture, public API
surface, schema, sweeping rewrites. Behavior preservation enforced
by running pytest before and after.
Simplify pass on shopdb/utils/responses.py:
- error_response docstring claimed the error info lives at top level
`error`. Implementation puts it under `data.error` (consistent with
the success envelope). Implementation is correct; docstring updated.
- paginated_response docstring used snake_case keys (`per_page`,
`total_pages`, etc). Implementation uses lowercase concatenated per
CONTRIBUTING.md. Docstring updated to match.
Documentation:
- docs/PLUGINS.md: bundled plugins (six, with what they track and
caveats per ADR), planned plugins (measuringtools as the scaffold
canary per ADR-005), distribution conventions for sister-site
plugins per ADR-003, naming policy.
- docs/ROADMAP.md: phase status table (0-5 done, 6 in progress),
must-have work for 1.0 (Asset.mapx/mapy, equipment migration,
printers retirement, frontend hook contract, per-plugin Alembic
chains), nice-to-have (measuringtools plugin, frontend scaffolding,
marketplace listing, surface-diff tooling), deferred (multi-tenancy,
pip-installable plugins, event bus). Defines what 1.0.0 means as a
contract.
Test count unchanged: 101 passing. Naming/style check green.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
