Commit Graph

37 Commits

Author SHA1 Message Date
cproudlock
be78e45320 Rework the first-run setup wizard around what a site cannot run without
The wizard configured five of the product's 129 settings. A site that finished
it still had no timezone, no authentication, no mail server, no backup
destination and no endpoint agent policy, and nothing told the operator so.

Six steps now: Administrator, Site, Authentication, Features, Mail and Backups,
Review. Everything else moves to a standing setup checklist at
/settings/setupchecklist, because a wizard that asked for all 129 settings would
be worse than one that asked for none.

Two new endpoints back it. /setup/checklist reports twelve areas as
ok/partial/todo/na with a link to the page that fixes each, and /setup/health
reports account counts plus whether a plugin toggle has reached every worker.
Both take care not to lie:

- Several settings are SEEDED non-empty (the shipped logo, a placeholder floor
  plan, every identifier field), so "is it set" compares against the shipped
  default rather than emptiness.
- plugin.endpoints.sharedkeyallowed DEFAULTS TO ALLOWED when its row is absent,
  so an absent row is reported as the fleet-wide key being accepted. Reporting
  it as refused told an admin the opposite of the truth about the credential
  they are migrating away from.
- A plugin is held at "starting" until several DISTINCT workers report it live.
  Counting replies instead let one recycled worker answer four times and declare
  a change complete while other workers still served the old routes.

Recommended plugins are declared in each plugin's manifest rather than listed in
the wizard, so adding a plugin cannot leave a stale list in another file.

Also fixed: the logo preview was invisible, because the image borrowed a class
that hardcodes a white background while the shipped logo is white; and signing
in did not re-read setup state, so an admin already browsing was never steered
to the wizard and a hard refresh was the only cure.

(cherry picked from commit 32d3f4b29d)
2026-09-20 12:41:57 -04:00
Proudlock
f9f1d39f08 Consolidate settings into 8 hubs and fix security vulnerabilities
Settings Consolidation (37+ pages to 8 hubs):
- Asset Type Hub: Unified type management with plugin descriptors
- Model Catalog Hub: Vendors, types, models, operating systems
- Asset Configuration Hub: Statuses, relationships, fields, identifiers
- Security Hub: Authentication, tokens, users, audit
- Site Configuration Hub: Site settings, floor map, branding, imports
- Integrations Hub: ServiceNow, Zabbix, Dell warranty
- Locations Hub: Locations, business units, employees
- Network Infrastructure Hub: VLANs, subnets

Plugin Descriptor Pattern:
- Add get_asset_type_descriptor hook to BasePlugin
- Implement descriptors in 6 plugins (printers, computers, machines, network, measuringtools, locations)
- Add /api/pluginui/asset-type-descriptors and core-type-descriptors endpoints
- Generic SubtypesTab component renders CRUD UI from descriptor schema

Security Fixes:
- Fix stored XSS via javascript: URIs in Models and Support Teams
- Add URL scheme validation (allow only http/https) in create/update endpoints
- Fix plugin contract violations in endpoints plugin (use shopdb.api imports)
- Add missing requiresAdmin guard to printer model supplies route
- Add user-facing error messages to API token load failures

Integration Improvements:
- Add persistent tab navigation to ServiceNow, Zabbix, and Dell Warranty settings
- Standardize integration settings UI across all three pages
- Fix tab visibility when navigating between integrations

Tested with 94-agent orchestrated review for ADR compliance and security.
2026-09-11 10:45:12 -04:00
ff9ae693a6 Remediate the 2026-09-03 feature-test findings 2026-09-03 17:14:53 -04:00
8666e0271c Reciprocal controls links, dead chip links, and a resumable legacy import
The machine page now shows the PC that controls it. The endpoint was correct all
along and returned both directions; AssetTriageBand discarded every peer whose
type was not 'machine' and was mounted only on the PC page. The counterpart type,
label and relationship types are now props.

Fixed while adopting it more widely: every band chip linked to /assets/<id>, and
there is no such route. The resolver that AssetRelationships.vue kept privately
is now frontend/src/utils/assetRoute.js, used by both - and its type lookup is
case-insensitive, because seed data capitalises the type names while this site's
database does not.

The legacy import is now safe to resume. The 409-resolve asked for
per_page=10000 against a server that clamps to 100, so it silently searched the
first 100 rows and dropped links past that on every re-run. The crosswalk is now
bound to the database it describes, so one carried across a rebuild is refused
rather than attaching rows to the wrong assets. Source database names are
resolved from the environment, so the loader can be aimed without editing it.

Full suite 2178 passed, frontend 280 passed.
2026-08-29 19:09:06 -04:00
benjamin.baker
c001657582 Merge remote-tracking branch 'origin/main' into wilm
# Conflicts:
#	shopdb/__init__.py
2026-08-28 09:30:35 -04:00
e8f1de811f nav items declare their permission 2026-08-27 14:51:04 -04:00
0c1fbfcc1e read permissions on every GET 2026-08-27 14:26:17 -04:00
4da6c6aa36 guest role; guide section ticking 2026-08-27 13:02:35 -04:00
376298dc02 Navigation sections declared, guide editor drag + references, USB settings, permission refresh 2026-08-27 09:30:08 -04:00
benjamin.baker
3deff4f716 Merge remote-tracking branch 'origin/main' into wilm
# Conflicts:
#	frontend/src/views/settings/SiteSettings.vue
2026-08-27 05:45:52 -04:00
4e38303326 Tab titles name the record; Guides reach a site and the contract surface 2026-08-26 13:31:13 -04:00
benjamin.baker
3b3a7cf910 Fix location dropdowns silently truncating at the 100-row backend cap
The backend clamps perpage to MAX_PAGE_SIZE (100), so location selectors that requested a large page received only the first page and still got a 200. Late-alphabet locations (past ~C5W) simply went missing from every module's dropdown, and no error surfaced.

Add locationsApi.listAll, which pages through the full set via fetchAllPages, matching the established machines/printers pattern, and switch every location selector consumer to it.
2026-08-26 13:25:07 -04:00
04107ff8ab Search spelling suggestions across every list 2026-08-21 11:15:06 -04:00
5a58d33623 Fix what the last round of device fixes broke, and two dips it missed 2026-08-21 08:50:00 -04:00
ebb86ccf3b Blank asset numbers, contested device claims, and honest toner forecasting 2026-08-20 17:09:02 -04:00
fa88ef0afe Device identity, collector enrollment file, and network device fixes 2026-08-20 15:10:24 -04:00
ece0e15f03 Page past the 100-row cap in pickers and batch label sheets 2026-08-17 14:17:28 -04:00
49f68081c3 Match the optional identifiers in every list's search box 2026-08-17 13:18:26 -04:00
fbd99041b0 Buildings and levels for the floor map, and make every identifier searchable 2026-08-17 13:03:54 -04:00
265ca2eb01 Security hardening, multi-site portability, and a documentation and API-surface sweep 2026-08-14 16:28:34 -04:00
d32513727b Tech Tools section with a code generator, toner report that names the part, toner forecasting, warranty proof of cover, application uploads 2026-08-12 11:51:38 -04:00
3b37603691 Dashboard cards: rebuild deployable dists 2026-08-11 14:31:24 -04:00
7c5b1bc74e Per-type board rows with shared categories, a network device IP field, and two dark-mode dialogs 2026-08-07 10:43:32 -04:00
c965494189 Remove the empty custom-fields box on the network device form 2026-08-05 14:43:10 -04:00
07d390789a Modal overlay-close removed from data-entry; console menu grouped 2026-08-05 13:49:34 -04:00
d3e7311376 Catalog seeding, blank-unique fix, slides rotation, console repair 2026-08-05 13:19:51 -04:00
9c530a70db Filter pagination reset; catalog model retype tool 2026-08-05 11:26:40 -04:00
50ac71d844 Qualify ambiguous Type labels 2026-08-05 10:33:47 -04:00
215d51e7df Model type shown only when it differs from the asset type 2026-08-05 10:16:21 -04:00
73940ae992 Vendor derived from catalog model; model type shown separately 2026-08-05 10:00:08 -04:00
c51e86e686 Model photo upload fixes; network devices linked to catalog models 2026-08-05 09:09:19 -04:00
59578e1c5b map marker legibility, PDF export blueprint fix, asset list type search 2026-07-31 09:06:22 -04:00
a69ce80f86 fix: blank location dropdowns + require printer model 2026-07-29 09:08:01 -04:00
cb9ede497d Kiosk entry input, gage lab tag column, model image subpath fix 2026-07-20 11:14:20 -04:00
de93b613cc ADR-013 Phase 4 complete: all plugin frontends self-contained + lint rule 2026-07-19 00:03:33 -04:00
d1592b84c7 ADR-013 Phase 4: all 13 plugin frontends relocated + staging machinery 2026-07-18 23:56:32 -04:00
a9d0dfff4a Initial import: shopdb-flask multi-site asset platform
Flask + Vue rewrite of the classic-ASP shopdb, built as a plugin
framework so sister GE Aerospace sites can adopt it. Product version
0.7.0-pre-0.8.0, plugin contract 0.11.0, 966 backend tests.

Key entry points:
- docs/INSTALL-WINDOWS-IIS.md - tested Windows + IIS install runbook
  (own-site and subpath deployment methods)
- docs/PILOT-DEPLOY.md - production pilot: stand up + import + verify
- docs/IMPORT-API.md - schema-agnostic legacy data import contract
- scripts/site_imports/wjf/ - West Jefferson reference import loader
- docs/adr/ - twelve accepted architecture decision records
2026-07-14 07:58:51 -04:00