0f56653345
Two failures from the same root: an administrator cannot see the kiosk token, and a screen that was provisioned wrongly does not say so. The settings API masks every key whose name contains 'token', so the settings page shows '********'. The real value is visible for one moment - after Generate, before Save - and an administrator who copies the field at any other time provisions a screen with the literal mask. The kiosk then answers 404, exactly as it answers a caller it has never heard of, because the route deliberately does not advertise itself. Nothing anywhere says what went wrong. - Each kiosk gains a permission-gated provisioning-link route that returns the real setup URL, token included, to somebody who already holds settings.edit. The mask stays: a token has no business in an ordinary settings list. The copy step just stops depending on catching the one moment it is on screen. Revealing it writes an audit row, since that is when the value left the database. Both settings pages get a "Copy setup link" button, which falls back to showing the link when the clipboard is refused - it is, over plain http and in locked-down browsers. - The USB kiosk asks the server on load whether this screen may be used, and says plainly when it may not. It rendered a keypad and only failed once somebody had typed their SSO, which reads as broken rather than as not set up. It cannot guess: the enabled flag is public and only says the site has a kiosk, and a caller admitted by network holds no token to look for, so the parts kiosk's localStorage check would warn exactly the callers the allowlist exists to serve. The probe is a badge-less session request - the gate runs before any badge handling, so refused is 404 and admitted is the validation error, with no lookup and nothing recorded. A test pins that ordering, because reordering it would start telling admitted screens they are not set up. Verified in a browser, not only in tests: provisioning with the mask lands on the refused screen, a correct token gets the drive list and survives a plain revisit, and a tokenless caller inside the allowlist gets straight in.
Printedparts plugin
3D-printed parts inventory + kiosk checkout
This plugin was generated by flask plugin new printedparts. It satisfies the framework contract out of the box. Replace the example model and routes with your domain.
What's here
plugin.py- thePrintedpartsPluginclass extendingBasePlugin. Editinit_appfor custom setup,on_installto seed reference data.models/printedparts.py- example Asset extension table. Replaceexamplefieldwith your domain fields.api/routes.py- example list and detail endpoints. Add CRUD as needed.schemas/__init__.py- marshmallow schema stub for request/response validation.tests/test_plugin.py- smoke tests asserting contract compliance.manifest.json- plugin metadata. Bumpversionon changes; keepcore_versionrange broad.
Common edits
| You want to... | Do this |
|---|---|
| Add a hook (search, navigation, dashboard widget) | Override the method in PrintedpartsPlugin. See the PLUGIN-HOOKS wiki page. |
| Accept external collector data | Override get_collector_schema() to return a JSON Schema. See ADR-006. |
| Add another model | Create models/<other>.py, export it in models/__init__.py, return it in get_models(). |
| Add a CLI command | Override get_cli_commands() returning a list of Click commands. |
Frontend
Vue components for this plugin live under frontend/src/views/printedparts/ (per project convention). Backend scaffolding does not generate frontend yet; copy from an existing plugin's view files (e.g., frontend/src/views/network/) as a starting point.
Install and run
flask plugin install printedparts
flask db migrate -m "Add printedparts plugin tables"
flask db upgrade
pytest plugins/printedparts/tests/
References
- the PLUGIN-HOOKS wiki page - canonical hook reference
- the PLUGIN-QUICKSTART wiki page - 30-minute walkthrough
migrations/adr/ADR-001-asset-as-platform-contract.md- the platform contractmigrations/adr/ADR-002-plugin-versioning.md- versioning rules
Why the kiosk take endpoint is unauthenticated
POST /api/printedparts/kiosk/take is the product's first open WRITE (every
other kiosk endpoint is a read). Accepted deliberately, against the criteria
in docs/proposals/printedparts-plugin.md:
- Decrement-only: it can reduce stock of an active item, nothing else.
- Fully attributed: it refuses to act without a badge that resolves under the site policy; every action lands in the ledger with SSO + name + time.
- Bounded blast radius: worst case is stock counts driven low - visible in the ledger and reversible with an adjust.
- Physically rate-limited: it serves a touch screen on the shop floor; nothing enumerable, nothing worth scraping.
Any future open-write endpoint must clear the same bar.