Adding Manufacturers and ScopeModels

app/api/manufacturers.py

@@ -0,0 +1,76 @@
+from fastapi import APIRouter, Depends, HTTPException, status
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.core.database import get_db
+from app.crud import manufacturer as manufacturer_crud
+from app.deps import require_permission
+from app.models.user import User
+from app.schemas.manufacturer import ManufacturerCreate, ManufacturerRead, ManufacturerUpdate
+
+router = APIRouter()
+
+
+@router.get("", response_model=list[ManufacturerRead])
+async def list_manufacturers(
+    skip: int = 0,
+    limit: int = 100,
+    db: AsyncSession = Depends(get_db),
+    _: User = Depends(require_permission("manufacturers:read")),
+):
+    return await manufacturer_crud.list_all(db, skip=skip, limit=limit)
+
+
+@router.post("", response_model=ManufacturerRead, status_code=status.HTTP_201_CREATED)
+async def create_manufacturer(
+    payload: ManufacturerCreate,
+    db: AsyncSession = Depends(get_db),
+    _: User = Depends(require_permission("manufacturers:write")),
+):
+    return await manufacturer_crud.create(
+        db,
+        name=payload.name,
+        url=str(payload.url),
+        logo_url=str(payload.logo_url) if payload.logo_url else None,
+    )
+
+
+@router.get("/{manufacturer_id}", response_model=ManufacturerRead)
+async def get_manufacturer(
+    manufacturer_id: int,
+    db: AsyncSession = Depends(get_db),
+    _: User = Depends(require_permission("manufacturers:read")),
+):
+    m = await manufacturer_crud.get(db, manufacturer_id)
+    if m is None:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Manufacturer not found")
+    return m
+
+
+@router.patch("/{manufacturer_id}", response_model=ManufacturerRead)
+async def update_manufacturer(
+    manufacturer_id: int,
+    payload: ManufacturerUpdate,
+    db: AsyncSession = Depends(get_db),
+    _: User = Depends(require_permission("manufacturers:write")),
+):
+    m = await manufacturer_crud.get(db, manufacturer_id)
+    if m is None:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Manufacturer not found")
+    data = payload.model_dump(exclude_unset=True)
+    if "url" in data and data["url"] is not None:
+        data["url"] = str(data["url"])
+    if "logo_url" in data and data["logo_url"] is not None:
+        data["logo_url"] = str(data["logo_url"])
+    return await manufacturer_crud.update(db, m, data)
+
+
+@router.delete("/{manufacturer_id}", status_code=status.HTTP_204_NO_CONTENT)
+async def delete_manufacturer(
+    manufacturer_id: int,
+    db: AsyncSession = Depends(get_db),
+    _: User = Depends(require_permission("manufacturers:delete")),
+):
+    m = await manufacturer_crud.get(db, manufacturer_id)
+    if m is None:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Manufacturer not found")
+    await manufacturer_crud.delete(db, m)

app/api/router.py

@@ -1,6 +1,6 @@
 from fastapi import APIRouter
 
-from app.api import auth, iso_threads, roles, unc_threads, users
+from app.api import auth, iso_threads, manufacturers, roles, scope_models, unc_threads, users
 
 api_router = APIRouter()
 api_router.include_router(auth.router, prefix="/auth", tags=["auth"])
@@ -8,3 +8,5 @@ api_router.include_router(users.router, prefix="/users", tags=["users"])
 api_router.include_router(roles.router, prefix="/roles", tags=["roles"])
 api_router.include_router(iso_threads.router, prefix="/iso-threads", tags=["iso-threads"])
 api_router.include_router(unc_threads.router, prefix="/unc-threads", tags=["unc-threads"])
+api_router.include_router(manufacturers.router, prefix="/manufacturers", tags=["manufacturers"])
+api_router.include_router(scope_models.router, prefix="/scope-models", tags=["scope-models"])

app/api/scope_models.py

@@ -0,0 +1,74 @@
+from fastapi import APIRouter, Depends, HTTPException, status
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.core.database import get_db
+from app.crud import scope_model as scope_model_crud
+from app.deps import require_permission
+from app.models.user import User
+from app.schemas.scope_model import ScopeModelCreate, ScopeModelRead, ScopeModelUpdate
+
+router = APIRouter()
+
+
+@router.get("", response_model=list[ScopeModelRead])
+async def list_scope_models(
+    skip: int = 0,
+    limit: int = 100,
+    db: AsyncSession = Depends(get_db),
+    _: User = Depends(require_permission("scope_models:read")),
+):
+    return await scope_model_crud.list_all(db, skip=skip, limit=limit)
+
+
+@router.post("", response_model=ScopeModelRead, status_code=status.HTTP_201_CREATED)
+async def create_scope_model(
+    payload: ScopeModelCreate,
+    db: AsyncSession = Depends(get_db),
+    _: User = Depends(require_permission("scope_models:write")),
+):
+    return await scope_model_crud.create(
+        db,
+        name=payload.name,
+        manufacturer_id=payload.manufacturer_id,
+        url=str(payload.url) if payload.url else None,
+    )
+
+
+@router.get("/{scope_model_id}", response_model=ScopeModelRead)
+async def get_scope_model(
+    scope_model_id: int,
+    db: AsyncSession = Depends(get_db),
+    _: User = Depends(require_permission("scope_models:read")),
+):
+    sm = await scope_model_crud.get(db, scope_model_id)
+    if sm is None:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Scope model not found")
+    return sm
+
+
+@router.patch("/{scope_model_id}", response_model=ScopeModelRead)
+async def update_scope_model(
+    scope_model_id: int,
+    payload: ScopeModelUpdate,
+    db: AsyncSession = Depends(get_db),
+    _: User = Depends(require_permission("scope_models:write")),
+):
+    sm = await scope_model_crud.get(db, scope_model_id)
+    if sm is None:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Scope model not found")
+    data = payload.model_dump(exclude_unset=True)
+    if "url" in data and data["url"] is not None:
+        data["url"] = str(data["url"])
+    return await scope_model_crud.update(db, sm, data)
+
+
+@router.delete("/{scope_model_id}", status_code=status.HTTP_204_NO_CONTENT)
+async def delete_scope_model(
+    scope_model_id: int,
+    db: AsyncSession = Depends(get_db),
+    _: User = Depends(require_permission("scope_models:delete")),
+):
+    sm = await scope_model_crud.get(db, scope_model_id)
+    if sm is None:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Scope model not found")
+    await scope_model_crud.delete(db, sm)

app/crud/manufacturer.py

@@ -0,0 +1,46 @@
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.models.manufacturer import Manufacturer
+
+
+async def get(db: AsyncSession, manufacturer_id: int) -> Manufacturer | None:
+    return await db.get(Manufacturer, manufacturer_id)
+
+
+async def list_all(
+    db: AsyncSession, skip: int = 0, limit: int = 100
+) -> list[Manufacturer]:
+    result = await db.execute(
+        select(Manufacturer).order_by(Manufacturer.name).offset(skip).limit(limit)
+    )
+    return list(result.scalars().all())
+
+
+async def create(
+    db: AsyncSession,
+    *,
+    name: str,
+    url: str,
+    logo_url: str | None = None,
+) -> Manufacturer:
+    m = Manufacturer(name=name, url=url, logo_url=logo_url)
+    db.add(m)
+    await db.commit()
+    await db.refresh(m)
+    return m
+
+
+async def update(
+    db: AsyncSession, manufacturer: Manufacturer, data: dict
+) -> Manufacturer:
+    for field, value in data.items():
+        setattr(manufacturer, field, value)
+    await db.commit()
+    await db.refresh(manufacturer)
+    return manufacturer
+
+
+async def delete(db: AsyncSession, manufacturer: Manufacturer) -> None:
+    await db.delete(manufacturer)
+    await db.commit()

app/crud/scope_model.py

@@ -0,0 +1,44 @@
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.models.scope_model import ScopeModel
+
+
+async def get(db: AsyncSession, scope_model_id: int) -> ScopeModel | None:
+    return await db.get(ScopeModel, scope_model_id)
+
+
+async def list_all(
+    db: AsyncSession, skip: int = 0, limit: int = 100
+) -> list[ScopeModel]:
+    result = await db.execute(
+        select(ScopeModel).order_by(ScopeModel.name).offset(skip).limit(limit)
+    )
+    return list(result.scalars().all())
+
+
+async def create(
+    db: AsyncSession,
+    *,
+    name: str,
+    manufacturer_id: int,
+    url: str | None = None,
+) -> ScopeModel:
+    sm = ScopeModel(name=name, manufacturer_id=manufacturer_id, url=url)
+    db.add(sm)
+    await db.commit()
+    await db.refresh(sm, attribute_names=["manufacturer"])
+    return sm
+
+
+async def update(db: AsyncSession, scope_model: ScopeModel, data: dict) -> ScopeModel:
+    for field, value in data.items():
+        setattr(scope_model, field, value)
+    await db.commit()
+    await db.refresh(scope_model, attribute_names=["manufacturer"])
+    return scope_model
+
+
+async def delete(db: AsyncSession, scope_model: ScopeModel) -> None:
+    await db.delete(scope_model)
+    await db.commit()

app/models/__init__.py

@@ -2,7 +2,9 @@
 
 from app.models.associations import role_permissions, user_roles
 from app.models.iso_thread import IsoThread
+from app.models.manufacturer import Manufacturer
 from app.models.permission import Permission
+from app.models.scope_model import ScopeModel
 from app.models.refresh_token import RefreshToken
 from app.models.role import Role
 from app.models.unc_thread import UncThread
@@ -10,7 +12,9 @@ from app.models.user import User
 
 __all__ = [
     "IsoThread",
+    "Manufacturer",
     "Permission",
+    "ScopeModel",
     "RefreshToken",
     "Role",
     "UncThread",

app/models/manufacturer.py

@@ -0,0 +1,12 @@
+from sqlalchemy.orm import Mapped, mapped_column
+
+from app.core.database import Base
+
+
+class Manufacturer(Base):
+    __tablename__ = "manufacturers"
+
+    id: Mapped[int] = mapped_column(primary_key=True)
+    name: Mapped[str] = mapped_column(nullable=False)
+    url: Mapped[str] = mapped_column(nullable=False)
+    logo_url: Mapped[str | None] = mapped_column(nullable=True, default=None)

app/models/scope_model.py

@@ -0,0 +1,18 @@
+from sqlalchemy import ForeignKey
+from sqlalchemy.orm import Mapped, mapped_column, relationship
+
+from app.core.database import Base
+from app.models.manufacturer import Manufacturer
+
+
+class ScopeModel(Base):
+    __tablename__ = "scope_models"
+
+    id: Mapped[int] = mapped_column(primary_key=True)
+    name: Mapped[str] = mapped_column(nullable=False)
+    manufacturer_id: Mapped[int] = mapped_column(
+        ForeignKey("manufacturers.id", ondelete="RESTRICT"), nullable=False
+    )
+    url: Mapped[str | None] = mapped_column(nullable=True, default=None)
+
+    manufacturer: Mapped[Manufacturer] = relationship(lazy="selectin")

app/schemas/manufacturer.py

@@ -0,0 +1,23 @@
+from pydantic import BaseModel, ConfigDict, HttpUrl
+
+
+class ManufacturerBase(BaseModel):
+    name: str
+    url: HttpUrl
+    logo_url: HttpUrl | None = None
+
+
+class ManufacturerCreate(ManufacturerBase):
+    pass
+
+
+class ManufacturerUpdate(BaseModel):
+    name: str | None = None
+    url: HttpUrl | None = None
+    logo_url: HttpUrl | None = None
+
+
+class ManufacturerRead(ManufacturerBase):
+    model_config = ConfigDict(from_attributes=True)
+
+    id: int

app/schemas/scope_model.py

@@ -0,0 +1,26 @@
+from pydantic import BaseModel, ConfigDict, HttpUrl
+
+from app.schemas.manufacturer import ManufacturerRead
+
+
+class ScopeModelBase(BaseModel):
+    name: str
+    manufacturer_id: int
+    url: HttpUrl | None = None
+
+
+class ScopeModelCreate(ScopeModelBase):
+    pass
+
+
+class ScopeModelUpdate(BaseModel):
+    name: str | None = None
+    manufacturer_id: int | None = None
+    url: HttpUrl | None = None
+
+
+class ScopeModelRead(ScopeModelBase):
+    model_config = ConfigDict(from_attributes=True)
+
+    id: int
+    manufacturer: ManufacturerRead

app/templates/_nav.html

@@ -14,6 +14,12 @@
     {% if user.is_superuser or "unc_threads:read" in user.permissions %}
       <a href="/admin/unc-threads">UNC Threads</a>
     {% endif %}
+    {% if user.is_superuser or "manufacturers:read" in user.permissions %}
+      <a href="/admin/manufacturers">Manufacturers</a>
+    {% endif %}
+    {% if user.is_superuser or "scope_models:read" in user.permissions %}
+      <a href="/admin/scope-models">Scope Models</a>
+    {% endif %}
     <a href="/docs" target="_blank">API docs</a>
   </nav>
   <form method="post" action="/logout" class="logout">

app/templates/admin/_manufacturer_row.html

@@ -0,0 +1,23 @@
+<tr id="manufacturer-{{ m.id }}">
+  <td>{{ m.id }}</td>
+  <td>{{ m.name }}</td>
+  <td><a href="{{ m.url }}" target="_blank" rel="noopener">{{ m.url }}</a></td>
+  <td>
+    {% if m.logo_url %}
+      <img src="{{ m.logo_url }}" alt="{{ m.name }} logo" style="max-height:2rem;">
+    {% else %}
+      <span class="muted">—</span>
+    {% endif %}
+  </td>
+  <td class="row-actions">
+    <button class="btn btn-ghost"
+            hx-get="/admin/manufacturers/{{ m.id }}/edit"
+            hx-target="#manufacturer-{{ m.id }}"
+            hx-swap="outerHTML">Edit</button>
+    <button class="btn btn-danger"
+            hx-delete="/admin/manufacturers/{{ m.id }}"
+            hx-target="#manufacturer-{{ m.id }}"
+            hx-swap="outerHTML"
+            hx-confirm="Delete {{ m.name }}?">Delete</button>
+  </td>
+</tr>

app/templates/admin/_manufacturer_row_edit.html

@@ -0,0 +1,20 @@
+<tr id="manufacturer-{{ m.id }}">
+  <td colspan="5">
+    <form hx-post="/admin/manufacturers/{{ m.id }}"
+          hx-target="#manufacturer-{{ m.id }}"
+          hx-swap="outerHTML"
+          class="inline-edit">
+      <span class="muted">#{{ m.id }}</span>
+      <label>Name <input type="text" name="name" value="{{ m.name }}" required></label>
+      <label>Homepage URL <input type="url" name="url" value="{{ m.url }}" required></label>
+      <label>Logo URL <input type="url" name="logo_url" value="{{ m.logo_url if m.logo_url is not none else '' }}" placeholder="optional"></label>
+      <div class="row-actions">
+        <button type="submit" class="btn btn-primary">Save</button>
+        <button type="button" class="btn btn-ghost"
+                hx-get="/admin/manufacturers/{{ m.id }}/row"
+                hx-target="#manufacturer-{{ m.id }}"
+                hx-swap="outerHTML">Cancel</button>
+      </div>
+    </form>
+  </td>
+</tr>

app/templates/admin/_manufacturers_table.html

@@ -0,0 +1,16 @@
+<div id="manufacturer-list" class="card">
+  <table class="table">
+    <thead>
+      <tr>
+        <th>ID</th><th>Name</th><th>Homepage</th><th>Logo</th><th></th>
+      </tr>
+    </thead>
+    <tbody>
+      {% for m in manufacturers %}
+        {% include "admin/_manufacturer_row.html" %}
+      {% else %}
+        <tr><td colspan="5" class="muted">No manufacturers recorded.</td></tr>
+      {% endfor %}
+    </tbody>
+  </table>
+</div>

app/templates/admin/_scope_model_row.html

@@ -0,0 +1,23 @@
+<tr id="scope-model-{{ sm.id }}">
+  <td>{{ sm.id }}</td>
+  <td>{{ sm.name }}</td>
+  <td>{{ sm.manufacturer.name }}</td>
+  <td>
+    {% if sm.url %}
+      <a href="{{ sm.url }}" target="_blank" rel="noopener">{{ sm.url }}</a>
+    {% else %}
+      <span class="muted">—</span>
+    {% endif %}
+  </td>
+  <td class="row-actions">
+    <button class="btn btn-ghost"
+            hx-get="/admin/scope-models/{{ sm.id }}/edit"
+            hx-target="#scope-model-{{ sm.id }}"
+            hx-swap="outerHTML">Edit</button>
+    <button class="btn btn-danger"
+            hx-delete="/admin/scope-models/{{ sm.id }}"
+            hx-target="#scope-model-{{ sm.id }}"
+            hx-swap="outerHTML"
+            hx-confirm="Delete {{ sm.name }}?">Delete</button>
+  </td>
+</tr>

app/templates/admin/_scope_model_row_edit.html

@@ -0,0 +1,26 @@
+<tr id="scope-model-{{ sm.id }}">
+  <td colspan="5">
+    <form hx-post="/admin/scope-models/{{ sm.id }}"
+          hx-target="#scope-model-{{ sm.id }}"
+          hx-swap="outerHTML"
+          class="inline-edit">
+      <span class="muted">#{{ sm.id }}</span>
+      <label>Name <input type="text" name="name" value="{{ sm.name }}" required></label>
+      <label>Manufacturer
+        <select name="manufacturer_id" required>
+          {% for mfr in manufacturers %}
+            <option value="{{ mfr.id }}" {% if mfr.id == sm.manufacturer_id %}selected{% endif %}>{{ mfr.name }}</option>
+          {% endfor %}
+        </select>
+      </label>
+      <label>Product page URL <input type="url" name="url" value="{{ sm.url if sm.url is not none else '' }}" placeholder="optional"></label>
+      <div class="row-actions">
+        <button type="submit" class="btn btn-primary">Save</button>
+        <button type="button" class="btn btn-ghost"
+                hx-get="/admin/scope-models/{{ sm.id }}/row"
+                hx-target="#scope-model-{{ sm.id }}"
+                hx-swap="outerHTML">Cancel</button>
+      </div>
+    </form>
+  </td>
+</tr>

app/templates/admin/_scope_models_table.html

@@ -0,0 +1,16 @@
+<div id="scope-model-list" class="card">
+  <table class="table">
+    <thead>
+      <tr>
+        <th>ID</th><th>Name</th><th>Manufacturer</th><th>Product Page</th><th></th>
+      </tr>
+    </thead>
+    <tbody>
+      {% for sm in scope_models %}
+        {% include "admin/_scope_model_row.html" %}
+      {% else %}
+        <tr><td colspan="5" class="muted">No scope models recorded.</td></tr>
+      {% endfor %}
+    </tbody>
+  </table>
+</div>

app/templates/admin/manufacturers.html

@@ -0,0 +1,20 @@
+{% extends "base.html" %}
+{% block title %}Manufacturers · {{ app_name }}{% endblock %}
+{% block body %}
+{% include "_nav.html" %}
+<main class="container">
+  <h1>Manufacturers</h1>
+
+  <div class="card">
+    <h2>Add manufacturer</h2>
+    <form hx-post="/admin/manufacturers" hx-target="#manufacturer-list" hx-swap="outerHTML" class="form-grid">
+      <label>Name <input type="text" name="name" required></label>
+      <label>Homepage URL <input type="url" name="url" required placeholder="https://"></label>
+      <label>Logo URL <input type="url" name="logo_url" placeholder="https:// (optional)"></label>
+      <button type="submit" class="btn btn-primary">Add</button>
+    </form>
+  </div>
+
+  {% include "admin/_manufacturers_table.html" %}
+</main>
+{% endblock %}

app/templates/admin/scope_models.html

@@ -0,0 +1,27 @@
+{% extends "base.html" %}
+{% block title %}Scope Models · {{ app_name }}{% endblock %}
+{% block body %}
+{% include "_nav.html" %}
+<main class="container">
+  <h1>Scope Models</h1>
+
+  <div class="card">
+    <h2>Add scope model</h2>
+    <form hx-post="/admin/scope-models" hx-target="#scope-model-list" hx-swap="outerHTML" class="form-grid">
+      <label>Name <input type="text" name="name" required></label>
+      <label>Manufacturer
+        <select name="manufacturer_id" required>
+          <option value="">— select —</option>
+          {% for mfr in manufacturers %}
+            <option value="{{ mfr.id }}">{{ mfr.name }}</option>
+          {% endfor %}
+        </select>
+      </label>
+      <label>Product page URL <input type="url" name="url" placeholder="https:// (optional)"></label>
+      <button type="submit" class="btn btn-primary">Add</button>
+    </form>
+  </div>
+
+  {% include "admin/_scope_models_table.html" %}
+</main>
+{% endblock %}

app/web/admin.py

@@ -6,7 +6,9 @@ from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.core.database import get_db
 from app.crud import iso_thread as iso_thread_crud
+from app.crud import manufacturer as manufacturer_crud
 from app.crud import role as role_crud
+from app.crud import scope_model as scope_model_crud
 from app.crud import unc_thread as unc_thread_crud
 from app.crud import user as user_crud
 from app.deps import get_current_web_user
@@ -483,3 +485,223 @@ async def delete_unc_thread(
     if thread is not None:
         await unc_thread_crud.delete(db, thread)
     return Response(status_code=status.HTTP_200_OK)
+
+
+# --- Manufacturers -----------------------------------------------------------
+
+
+@router.get("/manufacturers", response_class=HTMLResponse)
+async def manufacturers_page(
+    request: Request,
+    db: AsyncSession = Depends(get_db),
+    user: User = Depends(web_require("manufacturers:read")),
+):
+    return templates.TemplateResponse(
+        request,
+        "admin/manufacturers.html",
+        {"user": user, "manufacturers": await manufacturer_crud.list_all(db)},
+    )
+
+
+@router.post("/manufacturers", response_class=HTMLResponse)
+async def create_manufacturer(
+    request: Request,
+    name: str = Form(...),
+    url: str = Form(...),
+    logo_url: str = Form(""),
+    db: AsyncSession = Depends(get_db),
+    _: User = Depends(web_require("manufacturers:write")),
+):
+    await manufacturer_crud.create(
+        db,
+        name=name,
+        url=url,
+        logo_url=logo_url.strip() or None,
+    )
+    return templates.TemplateResponse(
+        request,
+        "admin/_manufacturers_table.html",
+        {"manufacturers": await manufacturer_crud.list_all(db)},
+    )
+
+
+@router.get("/manufacturers/{manufacturer_id}/edit", response_class=HTMLResponse)
+async def edit_manufacturer_row(
+    request: Request,
+    manufacturer_id: int,
+    db: AsyncSession = Depends(get_db),
+    _: User = Depends(web_require("manufacturers:write")),
+):
+    m = await manufacturer_crud.get(db, manufacturer_id)
+    if m is None:
+        raise HTTPException(status_code=404, detail="Manufacturer not found")
+    return templates.TemplateResponse(
+        request, "admin/_manufacturer_row_edit.html", {"m": m}
+    )
+
+
+@router.get("/manufacturers/{manufacturer_id}/row", response_class=HTMLResponse)
+async def manufacturer_row(
+    request: Request,
+    manufacturer_id: int,
+    db: AsyncSession = Depends(get_db),
+    _: User = Depends(web_require("manufacturers:read")),
+):
+    m = await manufacturer_crud.get(db, manufacturer_id)
+    if m is None:
+        raise HTTPException(status_code=404, detail="Manufacturer not found")
+    return templates.TemplateResponse(
+        request, "admin/_manufacturer_row.html", {"m": m}
+    )
+
+
+@router.post("/manufacturers/{manufacturer_id}", response_class=HTMLResponse)
+async def update_manufacturer(
+    request: Request,
+    manufacturer_id: int,
+    name: str = Form(...),
+    url: str = Form(...),
+    logo_url: str = Form(""),
+    db: AsyncSession = Depends(get_db),
+    _: User = Depends(web_require("manufacturers:write")),
+):
+    m = await manufacturer_crud.get(db, manufacturer_id)
+    if m is None:
+        raise HTTPException(status_code=404, detail="Manufacturer not found")
+    await manufacturer_crud.update(
+        db,
+        m,
+        {
+            "name": name,
+            "url": url,
+            "logo_url": logo_url.strip() or None,
+        },
+    )
+    return templates.TemplateResponse(
+        request, "admin/_manufacturer_row.html", {"m": m}
+    )
+
+
+@router.delete("/manufacturers/{manufacturer_id}")
+async def delete_manufacturer(
+    manufacturer_id: int,
+    db: AsyncSession = Depends(get_db),
+    _: User = Depends(web_require("manufacturers:delete")),
+):
+    m = await manufacturer_crud.get(db, manufacturer_id)
+    if m is not None:
+        await manufacturer_crud.delete(db, m)
+    return Response(status_code=status.HTTP_200_OK)
+
+
+# --- Scope Models ------------------------------------------------------------
+
+
+@router.get("/scope-models", response_class=HTMLResponse)
+async def scope_models_page(
+    request: Request,
+    db: AsyncSession = Depends(get_db),
+    user: User = Depends(web_require("scope_models:read")),
+):
+    return templates.TemplateResponse(
+        request,
+        "admin/scope_models.html",
+        {
+            "user": user,
+            "scope_models": await scope_model_crud.list_all(db),
+            "manufacturers": await manufacturer_crud.list_all(db),
+        },
+    )
+
+
+@router.post("/scope-models", response_class=HTMLResponse)
+async def create_scope_model(
+    request: Request,
+    name: str = Form(...),
+    manufacturer_id: int = Form(...),
+    url: str = Form(""),
+    db: AsyncSession = Depends(get_db),
+    _: User = Depends(web_require("scope_models:write")),
+):
+    await scope_model_crud.create(
+        db,
+        name=name,
+        manufacturer_id=manufacturer_id,
+        url=url.strip() or None,
+    )
+    return templates.TemplateResponse(
+        request,
+        "admin/_scope_models_table.html",
+        {"scope_models": await scope_model_crud.list_all(db)},
+    )
+
+
+@router.get("/scope-models/{scope_model_id}/edit", response_class=HTMLResponse)
+async def edit_scope_model_row(
+    request: Request,
+    scope_model_id: int,
+    db: AsyncSession = Depends(get_db),
+    _: User = Depends(web_require("scope_models:write")),
+):
+    sm = await scope_model_crud.get(db, scope_model_id)
+    if sm is None:
+        raise HTTPException(status_code=404, detail="Scope model not found")
+    return templates.TemplateResponse(
+        request,
+        "admin/_scope_model_row_edit.html",
+        {"sm": sm, "manufacturers": await manufacturer_crud.list_all(db)},
+    )
+
+
+@router.get("/scope-models/{scope_model_id}/row", response_class=HTMLResponse)
+async def scope_model_row(
+    request: Request,
+    scope_model_id: int,
+    db: AsyncSession = Depends(get_db),
+    _: User = Depends(web_require("scope_models:read")),
+):
+    sm = await scope_model_crud.get(db, scope_model_id)
+    if sm is None:
+        raise HTTPException(status_code=404, detail="Scope model not found")
+    return templates.TemplateResponse(
+        request, "admin/_scope_model_row.html", {"sm": sm}
+    )
+
+
+@router.post("/scope-models/{scope_model_id}", response_class=HTMLResponse)
+async def update_scope_model(
+    request: Request,
+    scope_model_id: int,
+    name: str = Form(...),
+    manufacturer_id: int = Form(...),
+    url: str = Form(""),
+    db: AsyncSession = Depends(get_db),
+    _: User = Depends(web_require("scope_models:write")),
+):
+    sm = await scope_model_crud.get(db, scope_model_id)
+    if sm is None:
+        raise HTTPException(status_code=404, detail="Scope model not found")
+    await scope_model_crud.update(
+        db,
+        sm,
+        {
+            "name": name,
+            "manufacturer_id": manufacturer_id,
+            "url": url.strip() or None,
+        },
+    )
+    return templates.TemplateResponse(
+        request, "admin/_scope_model_row.html", {"sm": sm}
+    )
+
+
+@router.delete("/scope-models/{scope_model_id}")
+async def delete_scope_model(
+    scope_model_id: int,
+    db: AsyncSession = Depends(get_db),
+    _: User = Depends(web_require("scope_models:delete")),
+):
+    sm = await scope_model_crud.get(db, scope_model_id)
+    if sm is not None:
+        await scope_model_crud.delete(db, sm)
+    return Response(status_code=status.HTTP_200_OK)