benjamin.baker d32293ccb2 Auto-register staged agent builds as a pushable application
Gate collect_log on a minimum agent version and bridge the agent version
store to the applications table so a staged build can actually be pushed.

update_app resolves an install source from the applications table alone; it
cannot see agentstore. A build could therefore be staged and current while no
application row existed at all, which is what the fleet was in: the agent was
unpushable. Staging is now the single source of truth - it packages the
current build and upserts the row in the same request, so the row cannot
describe a build that is no longer staged.

PARTIAL BUILD ADVISORY
This is steps 1-4 of a longer rollout and is deliberately incomplete:
  - There is no push trigger yet. The registered package is resolvable and
	verifiable, but nothing enqueues an upgrade; the "behind current build"
	indicator is still display-only.
  - The upgrade template script, its script row, and the enqueue route
	(endpoints.agentupdate) are not written.
  - Blocking constraint for the next slice: run_script executes
	powershell.exe -File <script> with NO argument channel, so a delivered
	upgrade script cannot be passed BaseUrl/CollectorKey and must either
	source them itself or run_script must be extended first.
Nothing here touches a live endpoint. Staging only changes what a future
push would contain.

Details:
  - Package members carry a fixed timestamp. zipfile stamps the current mtime
	by default, so identical input produced a different archive digest on
	every call. update_app pins a download by SHA-256, so a drifting hash
	would rewrite installersha256 out from under an endpoint mid-download and
	fail its verification.
  - All three routes that can change 'current' re-register (upload,
	adopt-legacy, rollback). Covering only upload would leave the row pinned
	to the build an operator just rolled away from, and the push would ship
	it anyway - silent drift.
  - Registration cannot fail an upload. The binary is staged and audited by
	the time it runs, so a packaging problem is reported in the response
	payload rather than raised; returning an error would tell the operator a
	successful upload was rejected.
  - The package is written to a temp name and os.replace'd, so an interrupted
	write cannot leave a truncated archive at the path the row advertises.
  - The row is isinstallable but hidden: machine-managed, and it must not
	appear in the software catalogue beside real licensed applications.
  - Added application_package_location() to the shopdb.api contract surface
	(lazy, matching collector_authorized) returning the package directory and
	URL prefix together. agentregistry reached into shopdb.core internals,
	violating the plugin import contract; sourcing both from one place also
	stops the write location and installpath from drifting apart.

collect_log is refused at enqueue below its minimum agent version, with
numeric comparison - string ordering misplaces 1.9.0.0 against 1.16.0. The
refusal is mirrored in the UI so a command slot is not spent on a call that
is guaranteed to fail.

Test isolation: create_app('testing') resolves instance_path to the real repo
instance/ directory, so agent upload tests write into the developer's actual
store. The new tests redirect both the store and package output into tmp_path
and include a guard test that fails if that isolation regresses. NOTE: the
pre-existing test_endpoints_agentupload.py still has this leak and deposits
1.5.0.0 and 1.6.3 into instance/siteagent/ on a full run - not fixed here.

Suite: 2834 passed, 11 skipped. The two failures (test_docs_publishable, and
a symlink scan needing Windows privileges) were confirmed pre-existing by
stashing this work and reproducing them.
2026-09-09 21:40:51 -04:00
2026-09-07 00:50:10 -04:00

ShopDB Flask

A modern rewrite of the classic ASP/VBScript ShopDB application using Flask (Python) and Vue 3. This application manages shop floor machines, PCs, printers, applications, and related infrastructure for manufacturing environments.

Overview

ShopDB tracks and manages:

  • Machines - CNC equipment, CMMs, inspection systems, etc.
  • PCs - Shopfloor computers, engineering workstations
  • Printers - Network printers with Zabbix supply integration
  • Network devices - Switches, routers, and the subnet browser
  • Measuring tools - Gage-lab instruments with calibration tracking
  • Applications - Software deployed across the shop floor, with per-PC install tracking
  • Employees - Directory, recognition and training notifications
  • Warranties - Coverage records with Dell warranty lookups
  • USB devices - CMMC check-in/out tracking
  • Knowledge Base - Documentation and troubleshooting guides
  • GE-Enforce manifests - Imaging/software manifest editing and fleet compliance

Tech Stack

Backend:

  • Python 3.14 with Flask
  • SQLAlchemy ORM
  • MySQL 5.7+ database (5.6 works with extra utf8mb4 config; see the DEPLOY wiki page)
  • JWT authentication
  • Plugin architecture for extensibility

Frontend:

  • Vue 3 with Composition API
  • Vue Router for navigation
  • Pinia for state management
  • Vite build system

Project Structure

shopdb-flask/
+-- shopdb/                 # Flask application
|   +-- core/
|   |   +-- api/            # REST API endpoints
|   |   +-- models/         # SQLAlchemy models
|   |   +-- schemas/        # Validation schemas
|   |   `-- services/       # Business logic
|   +-- plugins/            # Plugin system
|   `-- utils/              # Shared utilities
+-- frontend/               # Vue 3 application
|   +-- src/
|   |   +-- api/            # API client
|   |   +-- components/     # Reusable components
|   |   +-- views/          # Page components
|   |   +-- router/         # Route definitions
|   |   `-- stores/         # Pinia stores
|   `-- public/             # Static assets
+-- plugins/                # Bundled and external plugins
+-- migrations/             # Alembic migration chain (flask db upgrade)
+-- scripts/                # Import and utility scripts
`-- tests/                  # Test suite

Naming Conventions

To maintain consistency with the legacy ShopDB database and codebase, the following naming standards apply:

Database

  • Table names: Lowercase, single word, no underscores or dashes
    • Examples: assets, computers, printers, businessunits
  • Column names: Lowercase, single word, no underscores or dashes
    • Examples: assetid, assetnumber, hostname, isactive, createddate
  • Foreign keys: Referenced table name + id
    • Examples: locationid, vendorid, modelnumberid, computertypeid
  • Boolean columns: Prefixed with is or has
    • Examples: isactive, isshopfloor, iscolor, isdhcp, islicenced

Code

  • Python variables: Follow database naming where applicable (lowercase, no underscores for model fields)
  • JavaScript variables: camelCase for local variables, but match API field names from backend
  • Vue components: PascalCase for component names
  • CSS classes: Lowercase with dashes for multi-word classes

API

  • Endpoints: Lowercase, plural nouns
    • Examples: /api/machines, /api/computers, /api/locations
  • Query parameters: Lowercase, single word
    • Examples: ?locationid=5, ?isactive=true, ?assettype=computer

Style Guidelines

  • No emojis in code, comments, documentation, or UI
  • Keep UI functional and professional
  • Dark theme is the default
  • Consistent table layouts across all list views

Setup

Prerequisites

  • Python 3.14
  • Node.js 18+
  • MySQL 5.7+ (5.6 works with extra utf8mb4 config; see the DEPLOY wiki page)

ShopDB Flask uses MySQL as the canonical database. SQLite is used only for the test suite (TestingConfig in shopdb/config.py points at an in-memory SQLite). Do not run dev or production against SQLite.

Distribution

Source lives here. The Windows installer ships as a release asset rather than a file in the repository - it is around 240 MB, well past what a repository takes and well inside what a release asset does. There is no package or image registry; a site installs from that .exe or builds from source.

Fast path (Docker)

The Docker image builds the Vue frontend and serves it from the API container, so a container deploy needs no separate Node build step.

cp .env.example .env
# Edit .env: set SECRET_KEY, JWT_SECRET_KEY, DATABASE_URL, CORS_ORIGINS,
# and the MYSQL_* passwords (see the CONFIG wiki page for every variable).

docker compose up -d --build

# Create the schema and seed the platform data (idempotent, safe to re-run):
docker compose exec api flask db upgrade
docker compose exec api flask seed permissions
docker compose exec api flask seed settings
docker compose exec api flask seed reference-data

Then browse to the site and complete the first-run setup wizard at /setup (it creates the first admin account and captures site identity). To create the admin headlessly instead of using the wizard:

docker compose exec api flask seed admin --username admin --email admin@facility.example.com

Manual path (venv + Node)

# Backend
python -m venv venv
source venv/bin/activate
pip install -r requirements.txt
cp .env.example .env
# Edit .env with your database credentials and secrets.

export FLASK_APP=shopdb
flask db upgrade
flask plugin upgrade-all      # per-plugin schema (ADR-008)
flask seed permissions
flask seed settings
flask seed reference-data
flask run --port 5001         # MUST be 5001 - the frontend dev server proxies here

# Frontend (separate terminal)
cd frontend
npm install
npm run dev          # dev server on :5173
npm run build        # production build into frontend/dist (served by Flask)

Complete first-run setup at /setup, or run flask seed admin for a headless admin account. The repo ships VS Code config in .vscode/ (F5 debugs the backend; a "Dev site" task runs both servers). A fuller day-one walkthrough, including VS Code and troubleshooting, is the DEVELOPMENT-SETUP page in the project wiki.

To import a site's legacy data, use the HTTP import surface: an admin API token plus the IMPORT-API page in the project wiki drive the whole migration through documented endpoints (X-Import-Mode preserves original timestamps). scripts/site_imports/wjf/ is the reference site's loader, kept as a worked example of the whole sequence.

Which deployment route

Target Use
Windows Server + IIS (how sister sites run) the INSTALL-WINDOWS page in the project wiki - one installer .exe, offline, no manual IIS work. Day 2: the OPERATE-WINDOWS page in the project wiki
Linux / Docker, air-gapped the DEPLOY-AIRGAP page in the project wiki
Linux / Docker, connected the DEPLOY page in the project wiki

For every environment variable and Setting key see the CONFIG page in the project wiki.

What the Windows installer requires

The installer checks all of this before it changes anything and refuses rather than half-installing.

Minimum Notes
Windows Server 2019 (build 10.0.17763) Ships IIS 10.0, which is therefore the earliest IIS supported. Server 2016 is also IIS 10.0 but falls below the build floor and is refused.
Windows client (test boxes) 10 22H2 (build 10.0.19045) or 11 Pro or higher - Home has no IIS at all.
Architecture 64-bit The payload is cp314 win_amd64.
IIS Web Server role installed beforehand Install-WindowsFeature -Name Web-Server -IncludeManagementTools. Needs no internet.
Free disk 5 GB Refused below this. 40 GB is comfortable once uploads and config backups accumulate.
Database bundled MySQL 8.4 LTS, or your own Bring credentials if you use an existing server.

The binding constraint is the operating system rather than IIS: the payload is Python 3.14 plus HttpPlatformHandler and URL Rewrite, and the handler itself runs on older IIS. An older host is untested rather than known-broken.

If you must deploy onto something older, the INSTALL-WINDOWS-IIS page in the project wiki is the manual procedure and has no OS gate - it even documents MySQL 5.6, which is that era of machine. The trade is stated there: it produces a server the installer will not subsequently upgrade.

Configuration

Environment variables (.env):

Variable Description
DATABASE_URL MySQL connection string
SECRET_KEY Flask secret key
JWT_SECRET_KEY JWT signing key
JWT_ACCESS_TOKEN_EXPIRES Access token TTL (seconds)
LOG_LEVEL Logging verbosity

API Documentation

The REST API follows standard conventions:

Method Endpoint Description
GET /api/machines List machines (filterable by type)
GET /api/machines/:id Get machine details
POST /api/machines Create machine
PUT /api/machines/:id Update machine
DELETE /api/machines/:id Soft delete machine

Each asset plugin exposes the same CRUD pattern on its own prefix (/api/computers, /api/printers, /api/network, /api/measuringtools), and cross-cutting asset endpoints live under /api/assets.

Query parameters for list endpoints:

  • page - Page number (default: 1)
  • perpage - Items per page
  • sort - Sort field
  • dir - Sort direction (asc/desc)
  • search - Search term
  • assettype - Filter by asset type (computer, printer, machine, networkdevice, measuringtool)

Where to start

the START-HERE page in the project wiki routes by what you are here to do - standing up a site, deploying the shop-floor tools, writing a plugin, integrating with the API, or diagnosing something. On the published mirror the same page is the wiki's front door.

Plugin System

ShopDB supports plugins for extending functionality. See CONTRIBUTING.md for plugin development guidelines.

The image bundles these plugins; only the ones a site installs are loaded. The current count and each plugin's version and migration head are in the PROJECT-MAP page in the project wiki, which is generated:

  • backups - Machine configuration backups (NTLARS/DNC, CMM, part marker, UDC) with revision history and diffs
  • computers - Shopfloor PCs and workstations, collector fleet ingest
  • employees - Employee directory
  • geenforce - GE-Enforce imaging/software manifests and fleet compliance
  • machines - CNC, CMM, and other shop-floor machines
  • measuringtools - Gage-lab instruments with calibration tracking
  • knowledgebase - Documentation and troubleshooting guides
  • network - Network devices and subnets
  • notifications - Shopfloor notifications and recognition feed
  • printedparts - 3D-printed part catalogue, kiosk issue tracking and stock alerts
  • printers - Extended printer management with Zabbix integration
  • slides - TV/kiosk slideshows
  • tools - Tech Tools: barcode and QR generation laid out for real label stock
  • usb - CMMC USB check-in/out tracking
  • warranty - Warranty records with Dell lookups

Legacy Migration

This project replicates functionality from the classic ASP/VBScript ShopDB site. Key mappings:

Legacy Modern
ASP/VBScript Flask/Python
Classic ADO SQLAlchemy
Server-side HTML Vue 3 SPA
Session auth JWT tokens

License

Internal use only.

Description
Shop Database Flask Application with Vue 3 Frontend
Readme 98 MiB
Languages
Python 52.3%
Vue 19.7%
JavaScript 17.5%
PowerShell 5.5%
C# 2.8%
Other 2%