b516b9b771
- GET /settings now masks password/token values (were returned in plaintext to anonymous callers); sending the mask back on update is a no-op so the real secret is never clobbered. - Move the employee-directory DB credentials out of source into env-backed config (shopdb.utils.employee_db); employees + notification recognition use the shared helper. Employee lookups stop leaking exception strings. - Fix low-supplies report using loc.location instead of loc.locationname. Employee/notification read endpoints stay unauthenticated by design (public shopfloor kiosk displays consume them). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
21 lines
690 B
Python
21 lines
690 B
Python
"""Connection helper for the read-only employee directory database.
|
|
|
|
Credentials are pulled from app config (env-backed, see Config.EMPLOYEE_DB_*),
|
|
never hardcoded. Used by the employee lookup API and the notification
|
|
recognition feature.
|
|
"""
|
|
|
|
import pymysql
|
|
from flask import current_app
|
|
|
|
|
|
def employee_connection():
|
|
"""Open a pymysql connection to the employee directory DB."""
|
|
return pymysql.connect(
|
|
host=current_app.config['EMPLOYEE_DB_HOST'],
|
|
user=current_app.config['EMPLOYEE_DB_USER'],
|
|
password=current_app.config['EMPLOYEE_DB_PASSWORD'],
|
|
database=current_app.config['EMPLOYEE_DB_NAME'],
|
|
cursorclass=pymysql.cursors.DictCursor,
|
|
)
|