Making long running operations asynchronous

.claude/settings.local.json

@@ -13,7 +13,28 @@
       "Bash(docker build *)",
       "Bash(git status *)",
       "Bash(git -C /home/iroddis/dev/armament/fitguide status --short)",
-      "Bash(git -C /home/iroddis/dev/armament/fitguide log --oneline -10)"
+      "Bash(git -C /home/iroddis/dev/armament/fitguide log --oneline -10)",
+      "Bash(node --check /Users/roddis/dev/armament/fitguide/app/static/js/sortable-tables.js)",
+      "Bash(sqlite3 /Users/roddis/dev/armament/fitguide/app.db \"select count\\(*\\) from users;\")",
+      "Bash(sqlite3 /Users/roddis/dev/armament/fitguide/app.db \"select count\\(*\\) from part_colours;\")",
+      "Bash(sqlite3 /Users/roddis/dev/armament/fitguide/app.db \"select count\\(*\\) from manufacturers;\")",
+      "Bash(curl -s -c /tmp/fg_cookies.txt -o /dev/null -w \"login:%{http_code}\\\\n\" -d \"email=admin@armament.com&password=changethis\" http://localhost:8000/login)",
+      "Bash(curl -s -b /tmp/fg_cookies.txt http://localhost:8000/admin/manufacturers)",
+      "Bash(curl -s -o /dev/null -w \"%{http_code} %{content_type}\\\\n\" http://localhost:8000/static/js/sortable-tables.js)",
+      "Bash(curl -s -b /tmp/fg_cookies.txt \"http://localhost:8000/admin/augmented-parts\")",
+      "Bash(curl -s -b /tmp/fg_cookies.txt \"http://localhost:8000/admin/augmented-parts/filter?sort=colour&dir=desc\")",
+      "Bash(curl -s -b /tmp/fg_cookies.txt \"http://localhost:8000/admin/roles\")",
+      "Bash(curl -s http://localhost:8000/scopes)",
+      "Bash(curl -s -o /dev/null -w \"%{http_code}\\\\n\" http://localhost:8000/scopes)",
+      "Bash(curl -s -b /tmp/fg_cookies.txt http://localhost:8000/scopes)",
+      "Bash(lsof -ti:8000 -sTCP:LISTEN)",
+      "Bash(xargs -r kill)",
+      "Bash(rm -f /tmp/fg_cookies.txt /private/tmp/claude-501/-Users-roddis-dev-armament-fitguide/7873fd9c-2f2b-4583-877e-72fc88718f24/scratchpad/smoke_sort.py)",
+      "Bash(curl -s -o /dev/null -w \"%{http_code}\\\\n\" http://localhost:8000/login)",
+      "Bash(curl -s -b /tmp/fg_cookies.txt http://localhost:8000__TRACKED_VAR__)",
+      "Bash(sqlite3 app.db \"PRAGMA foreign_keys=ON; SELECT scope_model_id FROM augmented_parts WHERE id=1862;\")",
+      "Bash(sqlite3 app.db \"SELECT id, name FROM scope_models WHERE name='Viper';\")",
+      "Bash(sqlite3 app.db \"SELECT COUNT\\(*\\) FROM augmented_parts WHERE scope_model_id=\\(SELECT id FROM scope_models WHERE name='Viper'\\);\")"
     ]
   }
 }

CLAUDE.md

@@ -1,26 +1,41 @@
 # CLAUDE.md
 
-Guidance for working in this repo. Read alongside `README.md` (user-facing setup).
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+Guidance for working in this repo. Read alongside `README.md` (user-facing setup
+for the original FastAPI skeleton this app was built from).
 
 ## What this is
 
-A FastAPI skeleton serving **both** a JSON API (`/api/*`) and server-rendered
+**Fitguide**: a parts-compatibility guide for Armament scopes and accessories,
-HTML via **Jinja2 + HTMX** (`/`, `/admin/*`). Async SQLAlchemy 2.0 ORM, JWT auth
+built on a FastAPI skeleton that serves **both** a JSON API (`/api/*`) and
-with refresh-token revocation, and RBAC (users → roles → permissions).
+server-rendered HTML via **Jinja2 + HTMX** (`/`, `/scopes`, `/admin/*`). Async
+SQLAlchemy 2.0 ORM, JWT auth with refresh-token revocation (plus optional LDAP
+direct-bind login), and RBAC (users → roles → permissions). The domain layer on
+top of the skeleton tracks parts, their attachment points, and which parts fit
+together — see "Domain model" below.
 
 ## Commands
 
 ```bash
 uv sync --extra dev                    # install (incl. dev tools)
+uv run alembic upgrade head            # apply migrations
 uv run python -m scripts.seed          # seed perms/roles/superuser (idempotent)
 uv run uvicorn app.main:app --reload   # dev server on :8000
 uv run pytest                          # tests (in-memory SQLite)
+uv run pytest tests/test_foo.py::test_bar   # single test
 uv run ruff check . [--fix]            # lint
-uv run alembic upgrade head            # apply migrations
+uv run black .                         # format (ruff does not format here)
 uv run alembic revision --autogenerate -m "msg"   # new migration after model changes
 docker compose up --build              # app + Postgres, auto-seeded
 ```
 
+`Makefile` wraps the common ones (`make sync|seed|dev|test|fmt|migrate`).
+`make clean` deletes the local `app.db`, re-migrates, and reseeds — the quick
+way to get a clean dev database. `make seed` runs `alembic upgrade head` before
+seeding, i.e. day-to-day dev relies on migrations, not just
+`AUTO_CREATE_TABLES` (see "Database").
+
 ## Architecture / layering
 
 Request → router (`app/api/` JSON or `app/web/` HTML) → `app/crud/` (data access)
@@ -28,40 +43,106 @@ Request → router (`app/api/` JSON or `app/web/` HTML) → `app/crud/` (data ac
 token logic in `app/services/auth.py`. Keep route handlers thin; put DB logic in
 `crud/`, not in routers.
 
+`app/api/` is one router module per resource, all mounted under `/api` by
+`app/api/router.py`. `app/web/` is organized differently: `pages.py` (dashboard/
+login), `scopes.py` (the public-facing `/scopes` fit guide), and **`admin.py`**
+— a single ~3000-line router covering every admin screen (users, roles, part
+taxonomy tables, imported parts, augmented parts + detail + nested attachment
+points/fits, audit log, etc.), organized into `# --- Section ---` banner
+comments per resource rather than split into files. When adding an admin screen,
+follow the existing banner-section convention there rather than starting a new
+web router module.
+
+## Domain model
+
+The business domain, independent of the auth/RBAC skeleton:
+
+- **`AugmentedPart`** (`augmented_parts`) is the generic "part" entity — a
+  scope, flip cover, ARD, polarizer, adapter ring, etc. — distinguished by
+  `PartType`/`SubPartType`, with `PartColour`, `Manufacturer`, and an optional
+  `ScopeModel`. "Scope" is just one `PartType` value (see `SCOPE_TYPE_NAME` in
+  `app/services/scope_guide.py`), not a separate table.
+- **`ScopeInfo`** is a 1:1 extension of `AugmentedPart` (magnification,
+  objective thread, model suffix) populated only for scope-type parts.
+- **`AttachmentPoint`** belongs to one `AugmentedPart`, is named via
+  `AttachmentPointName` (e.g. "Ocular", "Objective"), and connects via
+  *exactly one* of `IsoThread` / `UncThread` / `ClampConnection` /
+  `StaticConnection` — that "exactly one" invariant is enforced in the app
+  layer (CRUD/API validation), not by a DB constraint.
+- **`Fit`** (`app/models/fit.py`) pairs two `AttachmentPoint`s (canonical
+  ordering enforced in `app/crud/fit.py` so a pair only ever has one row),
+  labeled `possible` / `exact` / `none`, with threaded `FitNote`s.
+  `app/services/fit_matching.py` computes `possible` fits automatically
+  (matching ISO/UNC thread specs exactly, or a static connection's dimension
+  falling inside a clamp connection's range); `exact`/`none` are user-asserted
+  and never touched by the algorithm.
+- **`ImportedPart`** (`imported_parts`, PK is the string `InventoryID` — not an
+  int id) holds raw rows from an external inventory feed, fetched via
+  `app/services/odata.py` (OData v4, paginated). `app/services/
+  augmented_part_sync.py` reconciles these into `AugmentedPart` +
+  `AttachmentPoint` rows: infers `PartType` by substring match on the
+  description, parses `TBXThreadAttribute` against ISO/UNC regexes (falling
+  back to an OD-derived `StaticConnection`), and prunes `AugmentedPart`s whose
+  backing `ImportedPart`s have disappeared.
+- **`app/services/scope_import.py`** is a separate, manually-triggered bulk
+  importer: reads an uploaded `.xlsx` of third-party scopes, upserting by
+  `product_number` (→ `AugmentedPart.sku`) and creating `ScopeModel`,
+  `ScopeInfo`, up to three `AttachmentPoint`s, and up to two `Fit`s per row
+  (see the module docstring for the full column mapping).
+- **`app/services/scope_guide.py`** assembles the `/scopes` page: one row per
+  Scope-type `AugmentedPart`, one column per other `PartType`, each cell
+  listing parts of that type with a recorded `Fit`.
+
 ## Conventions that matter
 
 - **Everything async.** Engine, sessions, CRUD, routes, tests. Use `await`; never
   add a sync DB call. `get_db` (in `app/core/database.py`) yields the request session.
-- **Relationships use `lazy="selectin"`** (`User.roles`, `Role.permissions`) so
+- **Relationships use `lazy="selectin"`** (`User.roles`, `Role.permissions`,
-  attributes are safe to read after the session closes — required under async.
+  `AttachmentPoint.iso_thread`, etc.) so attributes are safe to read after the
-  Preserve this when adding relationships that templates/schemas read.
+  session closes — required under async. Preserve this when adding relationships
+  that templates/schemas read.
 - **Config** is `app/core/config.py` (`pydantic-settings`). Add new settings there;
   they're auto-read from env vars (uppercased field name) or `.env`. Env wins.
 - **RBAC**: guard API routes with `Depends(require_permission("resource:action"))`;
   guard web routes with `web_require(...)` in `app/web/admin.py`. Superusers bypass
   all checks (`User.is_superuser` / `User.has_permission`). Add new permission
   strings to `scripts/seed.py`'s `PERMISSIONS`/`ROLES`.
+- **HTMX UI-level write gating**: on top of route-level RBAC, pages that mix
+  read-only and read-write viewers (e.g. `augmented_part_detail.html`'s Fits and
+  Attachment Points sections) compute a `can_write_<thing>` bool from the
+  current user's permissions and wrap add/edit/delete controls in
+  `{% if can_write_<thing> %}` in the template, so read-only users see data but
+  not controls they'd get a 403 on. The route-level `web_require(...)` check
+  remains the real security boundary; the template flag is only for UX.
 - **Auth, two transports**: API uses `Authorization: Bearer`; the HTMX UI uses an
   httpOnly cookie (`settings.cookie_name`). `app/deps.py` reads both. Web auth
-  failures raise `NotAuthenticated`, handled in `main.py` as a redirect to `/login`.
+  failures raise `NotAuthenticated`, handled in `main.py` as a redirect to `/login`
+  (preserving the original path as `?next=`).
 - **Refresh tokens** are stored server-side (hash + `jti` + `revoked`) in the
   `refresh_tokens` table. `services/auth.rotate_refresh_token` revokes-then-reissues.
   Note: JWT payload `exp` is a tz-aware `datetime` (PyJWT only epoch-encodes inside
   the token) — pass it straight to the model, don't `fromtimestamp` it.
+- **LDAP login** (`app/services/ldap.py`) is optional (`settings.ldap_enabled`),
+  direct-bind, and just-in-time provisions a local `User` on first successful
+  login. `ldap3` is sync, so its calls run via `run_in_threadpool`.
 
 ## Database
 
 One `DATABASE_URL` drives SQLite (`sqlite+aiosqlite://`, the default) or Postgres
 (`postgresql+asyncpg://`). `AUTO_CREATE_TABLES=true` calls `Base.metadata.create_all`
-on startup for dev convenience; production should use Alembic instead. `init_db()`
+on startup for dev convenience, but the day-to-day `make seed`/`make clean` flow
-imports `app.models` inside the function to avoid a circular import.
+runs `alembic upgrade head` first — treat Alembic migrations as the source of
+truth and keep them in sync with model changes. `init_db()` imports `app.models`
+inside the function to avoid a circular import.
 
 ## Tests
 
 `tests/conftest.py` builds an in-memory SQLite engine with `StaticPool`, creates
 tables, and overrides `get_db`. Fixtures: `client` (httpx ASGI), `seeded`
-(perms+roles), `make_user`. `asyncio_mode = "auto"` — write `async def test_*`
+(perms+roles from `scripts.seed.PERMISSIONS`/`ROLES`), `make_user`, and
-without decorators.
+`db_sessionmaker` (used directly in tests to seed domain rows — models, fits,
+attachment points — beyond what `seeded`/`make_user` cover). `asyncio_mode =
+"auto"` — write `async def test_*` without decorators.
 
 ## When extending
 

alembic/versions/8012c00b0c04_add_augmented_part_notes_table.py

@@ -0,0 +1,43 @@
+"""add_augmented_part_notes_table
+
+Revision ID: 8012c00b0c04
+Revises: d1e2f3a4b5c6
+Create Date: 2026-07-31 09:07:06.137175
+"""
+
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+# revision identifiers, used by Alembic.
+revision: str = "8012c00b0c04"
+down_revision: Union[str, None] = "d1e2f3a4b5c6"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        "augmented_part_notes",
+        sa.Column("id", sa.Integer(), nullable=False),
+        sa.Column("augmented_part_id", sa.Integer(), nullable=False),
+        sa.Column("user_id", sa.Integer(), nullable=True),
+        sa.Column("username", sa.String(length=255), nullable=False),
+        sa.Column("body", sa.Text(), nullable=False),
+        sa.Column(
+            "created_at",
+            sa.DateTime(timezone=True),
+            server_default=sa.func.now(),
+            nullable=False,
+        ),
+        sa.ForeignKeyConstraint(
+            ["augmented_part_id"], ["augmented_parts.id"], ondelete="CASCADE"
+        ),
+        sa.ForeignKeyConstraint(["user_id"], ["users.id"], ondelete="SET NULL"),
+        sa.PrimaryKeyConstraint("id"),
+    )
+
+
+def downgrade() -> None:
+    op.drop_table("augmented_part_notes")

app/api/augmented_parts.py

@@ -4,10 +4,13 @@ from sqlalchemy.ext.asyncio import AsyncSession
 from app.core.database import get_db
 from app.crud import audit as audit_crud
 from app.crud import augmented_part as augmented_part_crud
+from app.crud import augmented_part_note as augmented_part_note_crud
 from app.deps import require_permission
 from app.models.user import User
 from app.schemas.augmented_part import (
     AugmentedPartCreate,
+    AugmentedPartNoteCreate,
+    AugmentedPartNoteRead,
     AugmentedPartRead,
     AugmentedPartSyncResult,
     AugmentedPartUpdate,
@@ -132,3 +135,22 @@ async def delete_augmented_part(
             "AugmentedPart", augmented_part_id, label
         ),
     )
+
+
+@router.post(
+    "/{augmented_part_id}/notes",
+    response_model=AugmentedPartNoteRead,
+    status_code=status.HTTP_201_CREATED,
+)
+async def create_augmented_part_note(
+    augmented_part_id: int,
+    payload: AugmentedPartNoteCreate,
+    db: AsyncSession = Depends(get_db),
+    actor: User = Depends(require_permission("augmented_parts:write")),
+):
+    ap = await augmented_part_crud.get(db, augmented_part_id)
+    if ap is None:
+        raise HTTPException(status_code=404, detail="Augmented part not found")
+    return await augmented_part_note_crud.create(
+        db, augmented_part=ap, author=actor, body=payload.body
+    )

app/crud/augmented_part.py

@@ -4,9 +4,47 @@ from sqlalchemy.ext.asyncio import AsyncSession
 from app.models.associations import augmented_part_imported_parts
 from app.models.augmented_part import AugmentedPart
 from app.models.imported_part import ImportedPart
+from app.models.manufacturer import Manufacturer
+from app.models.part_colour import PartColour
+from app.models.part_type import PartType
+from app.models.scope_model import ScopeModel
+from app.models.sub_part_type import SubPartType
 
 _RELATIONSHIPS = ["colour", "manufacturer", "scope_model", "part_type", "sub_part_type"]
 
+# Sortable columns for the admin list, keyed by the query-string "sort" value.
+# Columns backed by a related table's name require an outer join (the FK may be
+# nullable, e.g. scope_model_id) so unrelated rows still appear, ordered last.
+SORT_COLUMNS = {
+    "id": (AugmentedPart.id, None),
+    "sku": (AugmentedPart.sku, None),
+    "description": (AugmentedPart.description, None),
+    "colour": (PartColour.name, (PartColour, AugmentedPart.colour_id == PartColour.id)),
+    "manufacturer": (
+        Manufacturer.name,
+        (Manufacturer, AugmentedPart.manufacturer_id == Manufacturer.id),
+    ),
+    "scope_model": (
+        ScopeModel.name,
+        (ScopeModel, AugmentedPart.scope_model_id == ScopeModel.id),
+    ),
+    "part_type": (PartType.name, (PartType, AugmentedPart.part_type_id == PartType.id)),
+    "sub_part_type": (
+        SubPartType.name,
+        (SubPartType, AugmentedPart.sub_part_type_id == SubPartType.id),
+    ),
+}
+
+
+def _apply_sort(q, sort: str, direction: str):
+    column, join = SORT_COLUMNS.get(sort, SORT_COLUMNS["description"])
+    if join is not None:
+        table, cond = join
+        q = q.outerjoin(table, cond)
+    order = column.desc() if direction == "desc" else column.asc()
+    # AugmentedPart.id as a tiebreaker keeps paginated ordering stable.
+    return q.order_by(order, AugmentedPart.id)
+
 
 async def get(db: AsyncSession, augmented_part_id: int) -> AugmentedPart | None:
     return await db.get(AugmentedPart, augmented_part_id)
@@ -35,9 +73,7 @@ async def get_many(db: AsyncSession, ids: list[int]) -> list[AugmentedPart]:
     """Fetch augmented parts by id in one query (selectin relationships loaded)."""
     if not ids:
         return []
-    result = await db.execute(
+    result = await db.execute(select(AugmentedPart).where(AugmentedPart.id.in_(ids)))
-        select(AugmentedPart).where(AugmentedPart.id.in_(ids))
-    )
     return list(result.scalars().all())
 
 
@@ -49,6 +85,8 @@ async def list_filtered(
     scope_model_id: int | None = None,
     part_type_id: int | None = None,
     sub_part_type_id: int | None = None,
+    sort: str = "description",
+    direction: str = "asc",
     skip: int = 0,
     limit: int = 100,
 ) -> list[AugmentedPart]:
@@ -65,9 +103,8 @@ async def list_filtered(
         q = q.where(AugmentedPart.part_type_id == part_type_id)
     if sub_part_type_id is not None:
         q = q.where(AugmentedPart.sub_part_type_id == sub_part_type_id)
-    result = await db.execute(
+    q = _apply_sort(q, sort, direction)
-        q.order_by(AugmentedPart.description).offset(skip).limit(limit)
+    result = await db.execute(q.offset(skip).limit(limit))
-    )
     return list(result.scalars().all())
 
 

app/crud/augmented_part_note.py

@@ -0,0 +1,19 @@
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.models.augmented_part import AugmentedPart, AugmentedPartNote
+from app.models.user import User
+
+
+async def create(
+    db: AsyncSession, *, augmented_part: AugmentedPart, author: User, body: str
+) -> AugmentedPartNote:
+    note = AugmentedPartNote(
+        augmented_part_id=augmented_part.id,
+        user_id=author.id,
+        username=author.full_name or author.email,
+        body=body,
+    )
+    db.add(note)
+    await db.commit()
+    await db.refresh(note)
+    return note

app/crud/imported_part.py

@@ -16,14 +16,37 @@ _FIELDS = frozenset(
     }
 )
 
+# Sortable columns for the admin list, keyed by the query-string "sort" value.
+SORT_COLUMNS = {
+    "InventoryID": ImportedPart.InventoryID,
+    "Description": ImportedPart.Description,
+    "TBXColour": ImportedPart.TBXColour,
+    "ProductMaxThreadDepthmm": ImportedPart.ProductMaxThreadDepthmm,
+    "ProductMaxThreadDepthin": ImportedPart.ProductMaxThreadDepthin,
+    "ProductODmm": ImportedPart.ProductODmm,
+    "ProductODin": ImportedPart.ProductODin,
+    "TBXThreadAttribute": ImportedPart.TBXThreadAttribute,
+}
+
+
+def _apply_sort(q, sort: str, direction: str):
+    column = SORT_COLUMNS.get(sort, ImportedPart.InventoryID)
+    order = column.desc() if direction == "desc" else column.asc()
+    return q.order_by(order, ImportedPart.InventoryID)
+
 
 async def get(db: AsyncSession, inventory_id: str) -> ImportedPart | None:
     return await db.get(ImportedPart, inventory_id)
 
 
-async def list_all(db: AsyncSession, skip: int = 0, limit: int = 500) -> list[ImportedPart]:
+async def list_all(
+    db: AsyncSession, skip: int = 0, limit: int = 500
+) -> list[ImportedPart]:
     result = await db.execute(
-        select(ImportedPart).order_by(ImportedPart.InventoryID).offset(skip).limit(limit)
+        select(ImportedPart)
+        .order_by(ImportedPart.InventoryID)
+        .offset(skip)
+        .limit(limit)
     )
     return list(result.scalars().all())
 
@@ -31,13 +54,16 @@ async def list_all(db: AsyncSession, skip: int = 0, limit: int = 500) -> list[Im
 async def list_filtered(
     db: AsyncSession,
     description: str = "",
+    sort: str = "InventoryID",
+    direction: str = "asc",
     skip: int = 0,
     limit: int = 500,
 ) -> list[ImportedPart]:
     q = select(ImportedPart)
     if description.strip():
         q = q.where(ImportedPart.Description.ilike(f"%{description.strip()}%"))
-    result = await db.execute(q.order_by(ImportedPart.InventoryID).offset(skip).limit(limit))
+    q = _apply_sort(q, sort, direction)
+    result = await db.execute(q.offset(skip).limit(limit))
     return list(result.scalars().all())
 
 
@@ -78,7 +104,11 @@ async def upsert_bulk(db: AsyncSession, records: list[dict]) -> tuple[int, int]:
         return 0, 0
 
     clean = [
-        {k: str(v).strip() if v is not None else None for k, v in r.items() if k in _FIELDS}
+        {
+            k: str(v).strip() if v is not None else None
+            for k, v in r.items()
+            if k in _FIELDS
+        }
         for r in records
         if r.get("InventoryID")
     ]
@@ -88,7 +118,9 @@ async def upsert_bulk(db: AsyncSession, records: list[dict]) -> tuple[int, int]:
     incoming_ids = {r["InventoryID"] for r in clean}
 
     result = await db.execute(
-        select(ImportedPart.InventoryID).where(ImportedPart.InventoryID.in_(incoming_ids))
+        select(ImportedPart.InventoryID).where(
+            ImportedPart.InventoryID.in_(incoming_ids)
+        )
     )
     existing_ids = {row[0] for row in result.all()}
 
@@ -103,7 +135,9 @@ async def upsert_bulk(db: AsyncSession, records: list[dict]) -> tuple[int, int]:
         vals = {k: v for k, v in record.items() if k != "InventoryID"}
         if vals:
             await db.execute(
-                update(ImportedPart).where(ImportedPart.InventoryID == inv_id).values(vals)
+                update(ImportedPart)
+                .where(ImportedPart.InventoryID == inv_id)
+                .values(vals)
             )
 
     await db.commit()

app/main.py

@@ -1,5 +1,6 @@
 from contextlib import asynccontextmanager
 from pathlib import Path
+from urllib.parse import quote
 
 from fastapi import FastAPI, Request
 from fastapi.middleware.cors import CORSMiddleware
@@ -45,7 +46,15 @@ def create_app() -> FastAPI:
 
     @app.exception_handler(NotAuthenticated)
     async def _redirect_to_login(request: Request, exc: NotAuthenticated):
-        return RedirectResponse(url="/login", status_code=302)
+        # Preserve the originally requested URL so we can return there after
+        # login. Only meaningful for GET navigations (the ones users deep-link).
+        login_url = "/login"
+        if request.method == "GET" and request.url.path not in ("/", "/login"):
+            target = request.url.path
+            if request.url.query:
+                target += "?" + request.url.query
+            login_url = f"/login?next={quote(target, safe='')}"
+        return RedirectResponse(url=login_url, status_code=302)
 
     @app.get("/healthz", tags=["health"])
     async def healthz():

app/models/__init__.py

@@ -8,7 +8,7 @@ from app.models.associations import (
 from app.models.attachment_point import AttachmentPoint
 from app.models.attachment_point_name import AttachmentPointName
 from app.models.audit_log import AuditLog
-from app.models.augmented_part import AugmentedPart
+from app.models.augmented_part import AugmentedPart, AugmentedPartNote
 from app.models.clamp_connection import ClampConnection
 from app.models.fit import Fit, FitLabel, FitNote
 from app.models.imported_part import ImportedPart
@@ -32,6 +32,7 @@ __all__ = [
     "AttachmentPointName",
     "AuditLog",
     "AugmentedPart",
+    "AugmentedPartNote",
     "ClampConnection",
     "Fit",
     "FitLabel",

app/models/augmented_part.py

@@ -1,4 +1,6 @@
-from sqlalchemy import ForeignKey, String
+from datetime import datetime
+
+from sqlalchemy import DateTime, ForeignKey, String, Text, func
 from sqlalchemy.orm import Mapped, mapped_column, relationship
 
 from app.core.database import Base
@@ -45,3 +47,30 @@ class AugmentedPart(Base):
     scope_model: Mapped[ScopeModel | None] = relationship(lazy="selectin")
     part_type: Mapped[PartType] = relationship(lazy="selectin")
     sub_part_type: Mapped[SubPartType | None] = relationship(lazy="selectin")
+    notes: Mapped[list["AugmentedPartNote"]] = relationship(
+        back_populates="augmented_part",
+        lazy="selectin",
+        order_by="AugmentedPartNote.created_at",
+        cascade="all, delete-orphan",
+    )
+
+
+class AugmentedPartNote(Base):
+    __tablename__ = "augmented_part_notes"
+
+    id: Mapped[int] = mapped_column(primary_key=True)
+    augmented_part_id: Mapped[int] = mapped_column(
+        ForeignKey("augmented_parts.id", ondelete="CASCADE"), nullable=False
+    )
+    user_id: Mapped[int | None] = mapped_column(
+        ForeignKey("users.id", ondelete="SET NULL"), nullable=True
+    )
+    # Denormalized snapshot of who wrote the note (mirrors FitNote.username), so
+    # the note stays attributable even if the user is later deleted.
+    username: Mapped[str] = mapped_column(String(255), nullable=False)
+    body: Mapped[str] = mapped_column(Text, nullable=False)
+    created_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), server_default=func.now()
+    )
+
+    augmented_part: Mapped[AugmentedPart] = relationship(back_populates="notes")

app/schemas/augmented_part.py

@@ -1,4 +1,6 @@
-from pydantic import BaseModel, ConfigDict
+from datetime import datetime
+
+from pydantic import BaseModel, ConfigDict, field_validator
 
 from app.schemas.manufacturer import ManufacturerRead
 from app.schemas.part_colour import PartColourRead
@@ -7,6 +9,28 @@ from app.schemas.scope_model import ScopeModelRead
 from app.schemas.sub_part_type import SubPartTypeRead
 
 
+class AugmentedPartNoteCreate(BaseModel):
+    body: str
+
+    @field_validator("body")
+    @classmethod
+    def validate_body(cls, v: str) -> str:
+        if not v.strip():
+            raise ValueError("body must not be blank")
+        return v.strip()
+
+
+class AugmentedPartNoteRead(BaseModel):
+    model_config = ConfigDict(from_attributes=True)
+
+    id: int
+    augmented_part_id: int
+    user_id: int | None
+    username: str
+    body: str
+    created_at: datetime
+
+
 class AugmentedPartBase(BaseModel):
     sku: str | None = None
     description: str
@@ -46,3 +70,4 @@ class AugmentedPartRead(AugmentedPartBase):
     scope_model: ScopeModelRead | None
     part_type: PartTypeRead
     sub_part_type: SubPartTypeRead | None
+    notes: list[AugmentedPartNoteRead] = []

app/services/augmented_part_sync.py

@@ -55,7 +55,7 @@ MM_PER_INCH = 25.4
 #   M50x.75    - No leading digit on floats
 #  Float pattern: \d*\.?\d+
 _ISO_THREAD_RE = re.compile(
-    r"^M\s*(?P<diameter>\d*\.?\d+)\s*[xX-]\s*P?(?P<pitch>\d*\.?\d+)(?P<extra>.*)$"
+    r"M\s*(?P<diameter>\d*\.?\d+)\s*[xX-]\s*P?(?P<pitch>\d*\.?\d+)(?P<extra>.*)"
 )
 
 # e.g.
@@ -65,8 +65,8 @@ _ISO_THREAD_RE = re.compile(
 #
 # Leading digit / period, one or more digits, a dash, then
 _UNC_THREAD_RE = re.compile(
-    r"^(?P<diameter>\d*\.?\d+)\s*-\s*(?P<tpi>\d*\.?\d+)"
+    r"(?P<diameter>\d*\.?\d+)\s*-\s*(?P<tpi>\d*\.?\d+)"
-    r"\s*(?P<series>UNEF|UNC|UNF|UNS|UN)?$",
+    r"\s*(?P<series>UNEF|UNC|UNF|UNS|UN)?",
     re.IGNORECASE,
 )
 
@@ -111,7 +111,9 @@ async def _get_or_create_attachment_point_name(db: AsyncSession, name: str):
     return apn
 
 
-async def _add_attachment_point(db: AsyncSession, ap: AugmentedPart, ip: ImportedPart) -> None:
+async def _add_attachment_point(
+    db: AsyncSession, ap: AugmentedPart, ip: ImportedPart
+) -> None:
     """Infer and create an attachment point for a newly-synced AugmentedPart.
 
     Preference order: TBXThreadAttribute (ISO/UNC thread) then ProductODmm/in
@@ -119,7 +121,11 @@ async def _add_attachment_point(db: AsyncSession, ap: AugmentedPart, ip: Importe
     attribute is present but unparseable.
     """
     thread_value = (ip.TBXThreadAttribute or "").strip()
-    parsed = _parse_thread_attribute(thread_value) if thread_value else None
+    parsed = None
+    if thread_value:
+        parsed = _parse_thread_attribute(thread_value)
+    else:
+        parsed = _parse_thread_attribute(ip.Description or "")
 
     if parsed is not None:
         kind, fields = parsed
@@ -127,7 +133,9 @@ async def _add_attachment_point(db: AsyncSession, ap: AugmentedPart, ip: Importe
 
         if kind == "iso":
             depth_mm = _parse_float(ip.ProductMaxThreadDepthmm)
-            thread = await iso_thread_crud.get_by_values(db, depth_mm=depth_mm, **fields)
+            thread = await iso_thread_crud.get_by_values(
+                db, depth_mm=depth_mm, **fields
+            )
             if thread is None:
                 thread = await iso_thread_crud.create(db, depth_mm=depth_mm, **fields)
             await attachment_point_crud.create(
@@ -138,7 +146,9 @@ async def _add_attachment_point(db: AsyncSession, ap: AugmentedPart, ip: Importe
             )
         elif kind == "unc":
             depth_in = _parse_float(ip.ProductMaxThreadDepthin)
-            thread = await unc_thread_crud.get_by_values(db, depth_in=depth_in, **fields)
+            thread = await unc_thread_crud.get_by_values(
+                db, depth_in=depth_in, **fields
+            )
             if thread is None:
                 thread = await unc_thread_crud.create(db, depth_in=depth_in, **fields)
             await attachment_point_crud.create(
@@ -236,7 +246,9 @@ async def sync(db: AsyncSession) -> AugmentedPartSyncResult:
     # ------------------------------------------------------------------ phase 1
 
     # IDs referenced in existing associations
-    result = await db.execute(select(augmented_part_imported_parts.c.imported_part_id).distinct())
+    result = await db.execute(
+        select(augmented_part_imported_parts.c.imported_part_id).distinct()
+    )
     all_linked_ids: set[str] = {row[0] for row in result.all()}
 
     # IDs that still exist in imported_parts
@@ -250,7 +262,9 @@ async def sync(db: AsyncSession) -> AugmentedPartSyncResult:
         # Which AugmentedParts are affected?
         result = await db.execute(
             select(augmented_part_imported_parts.c.augmented_part_id).where(
-                augmented_part_imported_parts.c.imported_part_id.in_(orphaned_import_ids)
+                augmented_part_imported_parts.c.imported_part_id.in_(
+                    orphaned_import_ids
+                )
             )
         )
         orphaned_ap_ids: set[int] = {row[0] for row in result.all()}
@@ -258,7 +272,9 @@ async def sync(db: AsyncSession) -> AugmentedPartSyncResult:
         # Remove the stale association rows
         await db.execute(
             augmented_part_imported_parts.delete().where(
-                augmented_part_imported_parts.c.imported_part_id.in_(orphaned_import_ids)
+                augmented_part_imported_parts.c.imported_part_id.in_(
+                    orphaned_import_ids
+                )
             )
         )
         await db.flush()
@@ -281,7 +297,9 @@ async def sync(db: AsyncSession) -> AugmentedPartSyncResult:
     # ------------------------------------------------------------------ phase 2
 
     # Re-query linked IDs after phase 1 cleanup
-    result = await db.execute(select(augmented_part_imported_parts.c.imported_part_id).distinct())
+    result = await db.execute(
+        select(augmented_part_imported_parts.c.imported_part_id).distinct()
+    )
     now_linked_ids: set[str] = {row[0] for row in result.all()}
     unlinked_ids = current_ids - now_linked_ids
 
@@ -289,7 +307,9 @@ async def sync(db: AsyncSession) -> AugmentedPartSyncResult:
     skipped = 0
 
     if not unlinked_ids:
-        return AugmentedPartSyncResult(created=created, deleted=deleted, skipped=skipped)
+        return AugmentedPartSyncResult(
+            created=created, deleted=deleted, skipped=skipped
+        )
 
     result = await db.execute(
         select(ImportedPart).where(ImportedPart.InventoryID.in_(unlinked_ids))

app/services/jobs.py

@@ -0,0 +1,74 @@
+"""Lightweight in-process tracking for long-running admin operations.
+
+Jobs live in a module-level dict, so this only works correctly for a single
+OS process (the app's current deployment: one uvicorn worker, no multi-process
+or multi-replica setup — see ``entrypoint.sh`` / ``docker-compose.yml``). If
+the app is ever scaled to multiple workers/replicas, this needs to move to
+shared storage (a DB table, Redis) so a poll request landing on a different
+process can still see the job.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import uuid
+from collections.abc import Awaitable, Callable
+from dataclasses import dataclass, field
+from datetime import UTC, datetime
+
+_MAX_FINISHED_AGE_SECONDS = 3600
+
+
+@dataclass
+class Job:
+    id: str
+    kind: str
+    status: str = "running"  # running | done | error
+    message: str = "Working…"
+    result: object | None = None
+    created_at: datetime = field(default_factory=lambda: datetime.now(UTC))
+    finished_at: datetime | None = None
+
+
+_jobs: dict[str, Job] = {}
+
+
+def get(job_id: str) -> Job | None:
+    return _jobs.get(job_id)
+
+
+def _evict_stale() -> None:
+    now = datetime.now(UTC)
+    stale = [
+        job_id
+        for job_id, job in _jobs.items()
+        if job.finished_at
+        and (now - job.finished_at).total_seconds() > _MAX_FINISHED_AGE_SECONDS
+    ]
+    for job_id in stale:
+        del _jobs[job_id]
+
+
+def start(kind: str, run: Callable[[Job], Awaitable[None]]) -> Job:
+    """Create a job, launch ``run(job)`` in the background, and return it immediately.
+
+    ``run`` is responsible for updating ``job.status``/``job.message``/``job.result``
+    to reflect the outcome, including catching its own errors. Any exception that
+    escapes anyway is caught here as a last resort so the job doesn't hang forever
+    in "running" state.
+    """
+    _evict_stale()
+    job = Job(id=uuid.uuid4().hex, kind=kind)
+    _jobs[job.id] = job
+
+    async def _runner() -> None:
+        try:
+            await run(job)
+        except Exception as exc:
+            job.status = "error"
+            job.message = f"{kind} failed: {exc}"
+        finally:
+            job.finished_at = datetime.now(UTC)
+
+    asyncio.create_task(_runner())
+    return job

app/static/css/style.css

@@ -247,6 +247,37 @@ h2 {
   gap: 0.4rem;
 }
 
+/* Sortable table headers */
+table.sortable thead th:not([data-sort-off]) {
+  cursor: pointer;
+  user-select: none;
+}
+
+table.sortable thead th:not([data-sort-off]):hover {
+  color: var(--text);
+}
+
+table.sortable thead th[aria-sort]::after {
+  margin-left: 0.3rem;
+}
+
+table.sortable thead th[aria-sort="ascending"]::after {
+  content: "\25B2";
+}
+
+table.sortable thead th[aria-sort="descending"]::after {
+  content: "\25BC";
+}
+
+.sort-link {
+  color: inherit;
+  text-decoration: none;
+}
+
+.sort-link:hover {
+  text-decoration: underline;
+}
+
 /* Tags / definition lists */
 .tag {
   display: inline-block;

app/static/js/sortable-tables.js

@@ -0,0 +1,77 @@
+(function () {
+  "use strict";
+
+  function getCellText(row, index) {
+    var cell = row.children[index];
+    return cell ? cell.textContent.trim() : "";
+  }
+
+  function isEmptyValue(text) {
+    return text === "" || text === "—";
+  }
+
+  function isPureNumber(text) {
+    return /^-?\d+(\.\d+)?$/.test(text);
+  }
+
+  function columnIsNumeric(rows, index) {
+    var sawValue = false;
+    for (var i = 0; i < rows.length; i++) {
+      var text = getCellText(rows[i], index);
+      if (isEmptyValue(text)) continue;
+      sawValue = true;
+      if (!isPureNumber(text)) return false;
+    }
+    return sawValue;
+  }
+
+  function compareRows(a, b, index, numeric, dir) {
+    var textA = getCellText(a, index);
+    var textB = getCellText(b, index);
+    var emptyA = isEmptyValue(textA);
+    var emptyB = isEmptyValue(textB);
+    if (emptyA && emptyB) return 0;
+    if (emptyA) return 1;
+    if (emptyB) return -1;
+
+    var result = numeric
+      ? parseFloat(textA) - parseFloat(textB)
+      : textA.localeCompare(textB, undefined, { numeric: true, sensitivity: "base" });
+    return dir === "desc" ? -result : result;
+  }
+
+  function sortTable(table, th) {
+    var thead = table.tHead;
+    var tbody = table.tBodies[0];
+    if (!thead || !tbody) return;
+
+    var headerRow = thead.rows[0];
+    var index = Array.prototype.indexOf.call(headerRow.children, th);
+    if (index === -1) return;
+
+    var rows = Array.prototype.slice.call(tbody.rows);
+    if (rows.length < 2) return;
+
+    var nextDir = th.getAttribute("data-sort-dir") === "asc" ? "desc" : "asc";
+    Array.prototype.forEach.call(headerRow.children, function (cell) {
+      cell.removeAttribute("data-sort-dir");
+      cell.removeAttribute("aria-sort");
+    });
+    th.setAttribute("data-sort-dir", nextDir);
+    th.setAttribute("aria-sort", nextDir === "asc" ? "ascending" : "descending");
+
+    var numeric = columnIsNumeric(rows, index);
+    rows.sort(function (a, b) {
+      return compareRows(a, b, index, numeric, nextDir);
+    });
+    rows.forEach(function (row) {
+      tbody.appendChild(row);
+    });
+  }
+
+  document.addEventListener("click", function (event) {
+    var th = event.target.closest("table.sortable thead th");
+    if (!th || th.hasAttribute("data-sort-off") || th.textContent.trim() === "") return;
+    sortTable(th.closest("table"), th);
+  });
+})();

app/templates/_scopes_table_card.html

@@ -11,7 +11,7 @@
   {%- endif -%}
 {%- endmacro -%}
 <div id="scopes-table-card" class="card" style="overflow-x:auto">
-  <table class="table">
+  <table class="table sortable">
     <thead>
       <tr>
         <th>Scope</th>
@@ -21,7 +21,7 @@
         <th>Magnification</th>
         <th>Objective thread</th>
         {% for ct in column_types %}
-          <th>{{ ct.name }}</th>
+          <th data-sort-off>{{ ct.name }}</th>
         {% endfor %}
       </tr>
     </thead>

app/templates/admin/_attachment_point_names_table.html

@@ -1,5 +1,5 @@
 <div id="attachment-point-name-list" class="card">
-  <table class="table">
+  <table class="table sortable">
     <thead>
       <tr>
         <th>ID</th>

app/templates/admin/_attachment_point_row.html

@@ -20,7 +20,6 @@
 {% endif %}
 <tr id="attachment-point-{{ ap.id }}">
   <td>{{ ap.id }}</td>
-  <td>{{ ap.augmented_part.description | truncate(40) }}</td>
   <td>{{ ap.attachment_point_name.name }}</td>
   <td>{{ conn_type }}</td>
   <td><code>{{ conn_label }}</code></td>

app/templates/admin/_attachment_points_table.html

@@ -1,9 +1,8 @@
 <div id="attachment-point-list" class="card" style="overflow-x:auto">
-  <table class="table">
+  <table class="table sortable">
     <thead>
       <tr>
         <th>ID</th>
-        <th>Augmented Part</th>
         <th>Point Name</th>
         <th>Connection Type</th>
         <th>Connection</th>

app/templates/admin/_augmented_part_ap_row.html

@@ -22,6 +22,7 @@
   <span class="ap-item-name">{{ apoint.attachment_point_name.name }}</span>
   <span class="ap-item-type">{{ conn_type }}</span>
   <code class="ap-item-conn">{{ conn_label }}</code>
+  {% if can_write_attachment_points %}
   <div class="row-actions">
     <button class="btn btn-ghost"
             hx-get="/admin/augmented-parts/{{ apoint.augmented_part_id }}/attachment-points/{{ apoint.id }}/edit"
@@ -33,4 +34,5 @@
             hx-swap="outerHTML"
             hx-confirm="Delete this attachment point?">Delete</button>
   </div>
+  {% endif %}
 </div>

app/templates/admin/_augmented_part_attachment_points.html

@@ -7,6 +7,7 @@
     <p class="muted" style="font-size:0.85rem;margin:0 0 0.5rem">No attachment points yet.</p>
   {% endfor %}
 
+  {% if can_write_attachment_points %}
   <form hx-post="/admin/augmented-parts/{{ augmented_part_id }}/attachment-points"
         hx-target="#ap-{{ augmented_part_id }}-attachment-points"
         hx-swap="outerHTML"
@@ -35,4 +36,5 @@
     <div id="ap-{{ augmented_part_id }}-add-connection-options"></div>
     <button type="submit" class="btn btn-primary">Add</button>
   </form>
+  {% endif %}
 </div>

app/templates/admin/_augmented_part_fits.html

@@ -45,6 +45,16 @@
       </select>
     </label>
     <div id="ap-{{ augmented_part_id }}-fit-other-points"></div>
+    <label>Fit type
+      <select name="label">
+        <option value="exact" selected>Exact</option>
+        <option value="possible">Possible</option>
+        <option value="none">None</option>
+      </select>
+    </label>
+    <label>Note (optional)
+      <input type="text" name="note" placeholder="Add a note…">
+    </label>
     <button type="submit" class="btn btn-primary">Add fit</button>
   </form>
   {% endif %}

app/templates/admin/_augmented_part_notes.html

@@ -0,0 +1,22 @@
+<div id="ap-{{ augmented_part_id }}-notes" class="ap-inline-section">
+  <h3>Notes</h3>
+
+  <div class="fit-notes">
+    {% for note in notes %}
+      <div class="fit-note">
+        <span class="fit-note-meta">{{ note.username }} · {{ note.created_at.strftime("%Y-%m-%d %H:%M") }}</span>
+        <p class="fit-note-body">{{ note.body }}</p>
+      </div>
+    {% else %}
+      <p class="muted" style="font-size:0.85rem;margin:0 0 0.5rem">No notes recorded yet.</p>
+    {% endfor %}
+    {% if can_write_notes %}
+    <form hx-post="/admin/augmented-parts/{{ augmented_part_id }}/notes"
+          hx-target="#ap-{{ augmented_part_id }}-notes" hx-swap="outerHTML"
+          class="inline-edit fit-note-form">
+      <input type="text" name="body" placeholder="Add a note…" required>
+      <button type="submit" class="btn btn-ghost">Add note</button>
+    </form>
+    {% endif %}
+  </div>
+</div>

app/templates/admin/_augmented_parts_table.html

@@ -10,6 +10,8 @@
         hx-target="#augmented-parts-table-card"
         hx-trigger="input delay:300ms, change"
         hx-swap="outerHTML">
+    <input type="hidden" name="sort" value="{{ sort }}">
+    <input type="hidden" name="dir" value="{{ dir }}">
     <input type="text" name="description" placeholder="Filter by description…" value="{{ filter_description or '' }}">
     <select name="colour_id">
       <option value="">All colours</option>

app/templates/admin/_augmented_parts_table_card.html

@@ -1,16 +1,17 @@
+{% from "admin/_sort_macros.html" import sort_th %}
 <div id="augmented-parts-table-card" class="card">
   {% include "admin/_pagination.html" %}
   <table class="table">
     <thead>
       <tr>
-        <th>ID</th>
+        {{ sort_th("id", "ID", sort_headers) }}
-        <th>SKU</th>
+        {{ sort_th("sku", "SKU", sort_headers) }}
-        <th>Description</th>
+        {{ sort_th("description", "Description", sort_headers) }}
-        <th>Colour</th>
+        {{ sort_th("colour", "Colour", sort_headers) }}
-        <th>Manufacturer</th>
+        {{ sort_th("manufacturer", "Manufacturer", sort_headers) }}
-        <th>Model</th>
+        {{ sort_th("scope_model", "Model", sort_headers) }}
-        <th>Type</th>
+        {{ sort_th("part_type", "Type", sort_headers) }}
-        <th>Sub Type</th>
+        {{ sort_th("sub_part_type", "Sub Type", sort_headers) }}
         <th></th>
       </tr>
     </thead>

app/templates/admin/_clamp_connections_table.html

@@ -1,5 +1,5 @@
 <div id="clamp-connection-list" class="card">
-  <table class="table">
+  <table class="table sortable">
     <thead>
       <tr>
         <th>ID</th>

app/templates/admin/_fit_other_points_select.html

@@ -1,6 +1,13 @@
+{% if points %}
 <select name="other_attachment_point_id" required>
   <option value="">— select —</option>
   {% for p in points %}
     <option value="{{ p.id }}">{{ p.attachment_point_name.name }}</option>
   {% endfor %}
 </select>
+{% else %}
+<input type="hidden" name="other_attachment_point_id" value="">
+<p class="muted" style="font-size:0.85rem;margin:0">
+  This part has no attachment points yet — one matching yours will be created automatically.
+</p>
+{% endif %}

app/templates/admin/_imported_parts_table.html

@@ -11,6 +11,8 @@
           hx-target="#imported-parts-table-card"
           hx-trigger="input delay:300ms, change"
           hx-swap="outerHTML">
+      <input type="hidden" name="sort" value="{{ sort }}">
+      <input type="hidden" name="dir" value="{{ dir }}">
       <input type="text" name="description" placeholder="Filter by description…" value="{{ filter_description or '' }}">
     </form>
   </div>

app/templates/admin/_imported_parts_table_card.html

@@ -1,16 +1,17 @@
+{% from "admin/_sort_macros.html" import sort_th %}
 <div id="imported-parts-table-card" class="card" style="overflow-x:auto">
   {% include "admin/_pagination.html" %}
   <table class="table">
     <thead>
       <tr>
-        <th>InventoryID</th>
+        {{ sort_th("InventoryID", "InventoryID", sort_headers) }}
-        <th>Description</th>
+        {{ sort_th("Description", "Description", sort_headers) }}
-        <th>TBX Colour</th>
+        {{ sort_th("TBXColour", "TBX Colour", sort_headers) }}
-        <th>Max Thread Depth (mm)</th>
+        {{ sort_th("ProductMaxThreadDepthmm", "Max Thread Depth (mm)", sort_headers) }}
-        <th>Max Thread Depth (in)</th>
+        {{ sort_th("ProductMaxThreadDepthin", "Max Thread Depth (in)", sort_headers) }}
-        <th>OD (mm)</th>
+        {{ sort_th("ProductODmm", "OD (mm)", sort_headers) }}
-        <th>OD (in)</th>
+        {{ sort_th("ProductODin", "OD (in)", sort_headers) }}
-        <th>Thread Attribute</th>
+        {{ sort_th("TBXThreadAttribute", "Thread Attribute", sort_headers) }}
       </tr>
     </thead>
     <tbody>

app/templates/admin/_job_progress.html

@@ -0,0 +1,7 @@
+<div id="{{ container_id }}"
+     hx-get="{{ poll_url }}"
+     hx-trigger="load delay:1s"
+     hx-swap="outerHTML"
+     class="{{ extra_class or '' }}">
+  <p class="muted">⏳ {{ job.message }}</p>
+</div>

app/templates/admin/_job_progress_inline.html

@@ -0,0 +1,5 @@
+<span id="{{ container_id }}"
+      hx-get="{{ poll_url }}"
+      hx-trigger="load delay:1s"
+      hx-swap="outerHTML"
+      class="muted">⏳ {{ job.message }}</span>

app/templates/admin/_manufacturers_table.html

@@ -1,8 +1,8 @@
 <div id="manufacturer-list" class="card">
-  <table class="table">
+  <table class="table sortable">
     <thead>
       <tr>
-        <th>ID</th><th>Name</th><th>Homepage</th><th>Logo</th><th></th>
+        <th>ID</th><th>Name</th><th>Homepage</th><th data-sort-off>Logo</th><th></th>
       </tr>
     </thead>
     <tbody>

app/templates/admin/_part_colours_table.html

@@ -1,5 +1,5 @@
 <div id="part-colour-list" class="card">
-  <table class="table">
+  <table class="table sortable">
     <thead>
       <tr>
         <th>ID</th>

app/templates/admin/_part_types_table.html

@@ -1,5 +1,5 @@
 <div id="part-type-list" class="card">
-  <table class="table">
+  <table class="table sortable">
     <thead>
       <tr>
         <th>ID</th><th>Name</th><th></th>

app/templates/admin/_roles_table.html

@@ -1,7 +1,7 @@
 <div id="role-list" class="card">
-  <table class="table">
+  <table class="table sortable">
     <thead>
-      <tr><th>ID</th><th>Name</th><th>Description</th><th>Permissions</th><th>Default</th><th></th></tr>
+      <tr><th>ID</th><th>Name</th><th>Description</th><th data-sort-off>Permissions</th><th data-sort-off>Default</th><th></th></tr>
     </thead>
     <tbody>
       {% for r in roles %}

app/templates/admin/_scope_import_result.html

@@ -1,3 +1,4 @@
+<div id="{{ container_id or 'scope-import-result-body' }}">
 {% if error %}
 <div class="card">
   <p style="color:var(--color-danger,#c00)">{{ error }}</p>
@@ -39,3 +40,4 @@
   {% endif %}
 </div>
 {% endif %}
+</div>

app/templates/admin/_scope_models_table.html

@@ -1,5 +1,5 @@
 <div id="scope-model-list" class="card">
-  <table class="table">
+  <table class="table sortable">
     <thead>
       <tr>
         <th>ID</th><th>Name</th><th>Manufacturer</th><th>Product Page</th><th></th>

app/templates/admin/_sort_macros.html

@@ -0,0 +1,13 @@
+{% macro sort_th(key, label, sort_headers) %}
+  {% if sort_headers and key in sort_headers %}
+    {% set h = sort_headers[key] %}
+    <th>
+      <a href="#" class="sort-link{{ ' active' if h.active else '' }}"
+         hx-get="{{ h.url }}"
+         hx-target="{{ h.target_id }}"
+         hx-swap="outerHTML">{{ label }}{% if h.active %}<span aria-hidden="true">{{ ' ▲' if h.dir == 'asc' else ' ▼' }}</span>{% endif %}</a>
+    </th>
+  {% else %}
+    <th>{{ label }}</th>
+  {% endif %}
+{% endmacro %}

app/templates/admin/_static_connections_table.html

@@ -1,5 +1,5 @@
 <div id="static-connection-list" class="card">
-  <table class="table">
+  <table class="table sortable">
     <thead>
       <tr>
         <th>ID</th>

app/templates/admin/_sub_part_types_table.html

@@ -1,5 +1,5 @@
 <div id="sub-part-type-list" class="card">
-  <table class="table">
+  <table class="table sortable">
     <thead>
       <tr>
         <th>ID</th><th>Name</th><th>Parent Type</th><th></th>

app/templates/admin/_users_table.html

@@ -1,8 +1,8 @@
 <div id="user-list" class="card">
-  <table class="table">
+  <table class="table sortable">
     <thead>
       <tr>
-        <th>ID</th><th>Email</th><th>Name</th><th>Active</th><th>Superuser</th><th>Roles</th><th></th>
+        <th>ID</th><th>Email</th><th>Name</th><th>Active</th><th>Superuser</th><th data-sort-off>Roles</th><th></th>
       </tr>
     </thead>
     <tbody>

app/templates/admin/audit_log.html

@@ -7,7 +7,7 @@
 
   <div class="card">
     {% if entries %}
-    <table class="table">
+    <table class="table sortable">
       <thead>
         <tr>
           <th>Time</th>

app/templates/admin/augmented_part_detail.html

@@ -3,20 +3,6 @@
 {% block body %}
 {% include "_nav.html" %}
 
-{%- macro conn_desc(point) -%}
-  {%- if point.iso_thread -%}
-    ISO M{{ point.iso_thread.diameter_mm }}×{{ point.iso_thread.pitch_mm }}
-  {%- elif point.unc_thread -%}
-    UNC {{ point.unc_thread.diameter_fraction }}-{{ point.unc_thread.tpi }} {{ point.unc_thread.series.value }}
-  {%- elif point.clamp_connection -%}
-    Clamp {{ point.clamp_connection.min_mm if point.clamp_connection.min_mm is not none else point.clamp_connection.min_in }}–{{ point.clamp_connection.max_mm if point.clamp_connection.max_mm is not none else point.clamp_connection.max_in }}
-  {%- elif point.static_connection -%}
-    Static {{ point.static_connection.od_mm }} mm OD
-  {%- else -%}
-    —
-  {%- endif -%}
-{%- endmacro -%}
-
 <main class="container">
   <p><a href="/admin/augmented-parts" class="btn btn-ghost">← Augmented Parts</a></p>
 
@@ -62,24 +48,22 @@
       </dl>
     </div>
     {% endif %}
+  </div>
 
+  {% if can_read_attachment_points %}
   <div class="card">
-      <h2>Attachment points</h2>
+    {% include "admin/_augmented_part_attachment_points.html" %}
-      {% for point in attachment_points %}
-        <div class="ap-item">
-          <span class="ap-item-name">{{ point.attachment_point_name.name }}</span>
-          <code class="ap-item-conn">{{ conn_desc(point) }}</code>
-        </div>
-      {% else %}
-        <p class="muted">No attachment points recorded.</p>
-      {% endfor %}
-    </div>
   </div>
+  {% endif %}
 
   {% if can_read_fits %}
   <div class="card">
     {% include "admin/_augmented_part_fits.html" %}
   </div>
   {% endif %}
+
+  <div class="card">
+    {% include "admin/_augmented_part_notes.html" %}
+  </div>
 </main>
 {% endblock %}

app/templates/base.html

@@ -4,10 +4,12 @@
   <meta charset="utf-8">
   <meta name="viewport" content="width=device-width, initial-scale=1">
   <title>{% block title %}{{ app_name }}{% endblock %}</title>
+  <link rel="icon" href="/static/favicon.ico" sizes="any">
   <link rel="stylesheet" href="/static/css/style.css">
   <script src="https://unpkg.com/htmx.org@1.9.12"
           integrity="sha384-ujb1lZYygJmzgSwoxRggbCHcjc0rB2XoQrxeTUQyRjrOnlCoYta87iKBWq3EsdM2"
           crossorigin="anonymous"></script>
+  <script src="/static/js/sortable-tables.js" defer></script>
 </head>
 <body>
   {% block body %}{% endblock %}

app/templates/login.html

@@ -9,6 +9,7 @@
     {% if ldap_enabled %}
 
       <form method="post" action="/login/ldap">
+        <input type="hidden" name="next" value="{{ next_url or '' }}">
         {% if ldap_error %}<div class="alert">{{ ldap_error }}</div>{% endif %}
         <label>Username
           <input type="text" name="username" value="{{ username or '' }}" required autofocus>
@@ -22,6 +23,7 @@
       <details class="local-login-panel" {% if local_error %}open{% endif %}>
         <summary>Use a local account instead</summary>
         <form method="post" action="/login">
+          <input type="hidden" name="next" value="{{ next_url or '' }}">
           {% if local_error %}<div class="alert">{{ local_error }}</div>{% endif %}
           <label>Email
             <input type="email" name="email" value="{{ email or '' }}" required>
@@ -36,6 +38,7 @@
     {% else %}
 
       <form method="post" action="/login">
+        <input type="hidden" name="next" value="{{ next_url or '' }}">
         {% if local_error %}<div class="alert">{{ local_error }}</div>{% endif %}
         <label>Email
           <input type="email" name="email" value="{{ email or '' }}" required autofocus>

app/web/pages.py

@@ -1,4 +1,4 @@
-from fastapi import APIRouter, Depends, Form, HTTPException, Request, status
+from fastapi import APIRouter, Depends, Form, HTTPException, Query, Request, status
 from fastapi.responses import HTMLResponse, RedirectResponse, Response
 from sqlalchemy.ext.asyncio import AsyncSession
 
@@ -14,6 +14,21 @@ from app.web.templates import templates
 router = APIRouter(include_in_schema=False)
 
 
+def _safe_next(next_url: str) -> str:
+    """Return next_url only if it's a safe same-site path, else "/".
+
+    Guards against open-redirect: rejects absolute URLs and protocol-relative
+    ("//host", "/\\host") targets, and never bounces back to the auth pages.
+    """
+    if (
+        next_url.startswith("/")
+        and not next_url.startswith(("//", "/\\"))
+        and not next_url.startswith(("/login", "/logout"))
+    ):
+        return next_url
+    return "/"
+
+
 def _set_auth_cookie(response: Response, access_token: str) -> None:
     response.set_cookie(
         key=settings.cookie_name,
@@ -35,9 +50,11 @@ async def dashboard(
 
 
 @router.get("/login", response_class=HTMLResponse)
-async def login_page(request: Request):
+async def login_page(request: Request, next_url: str = Query("", alias="next")):
     return templates.TemplateResponse(
-        request, "login.html", {"ldap_enabled": settings.ldap_enabled}
+        request,
+        "login.html",
+        {"ldap_enabled": settings.ldap_enabled, "next_url": _safe_next(next_url)},
     )
 
 
@@ -46,6 +63,7 @@ async def login_submit(
     request: Request,
     email: str = Form(...),
     password: str = Form(...),
+    next_url: str = Form("", alias="next"),
     db: AsyncSession = Depends(get_db),
 ):
     user = await user_crud.authenticate(db, email, password)
@@ -57,11 +75,14 @@ async def login_submit(
                 "local_error": "Incorrect email or password",
                 "email": email,
                 "ldap_enabled": settings.ldap_enabled,
+                "next_url": _safe_next(next_url),
             },
             status_code=status.HTTP_401_UNAUTHORIZED,
         )
     access, _ = await issue_token_pair(db, user)
-    response = RedirectResponse(url="/", status_code=status.HTTP_303_SEE_OTHER)
+    response = RedirectResponse(
+        url=_safe_next(next_url), status_code=status.HTTP_303_SEE_OTHER
+    )
     _set_auth_cookie(response, access)
     return response
 
@@ -71,6 +92,7 @@ async def login_ldap_submit(
     request: Request,
     username: str = Form(...),
     password: str = Form(...),
+    next_url: str = Form("", alias="next"),
     db: AsyncSession = Depends(get_db),
 ):
     if not settings.ldap_enabled:
@@ -84,11 +106,14 @@ async def login_ldap_submit(
                 "ldap_error": "Incorrect username or password",
                 "username": username,
                 "ldap_enabled": True,
+                "next_url": _safe_next(next_url),
             },
             status_code=status.HTTP_401_UNAUTHORIZED,
         )
     access, _ = await issue_token_pair(db, user)
-    response = RedirectResponse(url="/", status_code=status.HTTP_303_SEE_OTHER)
+    response = RedirectResponse(
+        url=_safe_next(next_url), status_code=status.HTTP_303_SEE_OTHER
+    )
     _set_auth_cookie(response, access)
     return response
 

tests/test_admin_background_jobs.py

@@ -0,0 +1,156 @@
+import asyncio
+import re
+
+import pytest
+
+from app.crud import role as role_crud
+from app.models.attachment_point import AttachmentPoint
+from app.models.attachment_point_name import AttachmentPointName
+from app.models.augmented_part import AugmentedPart
+from app.models.part_type import PartType
+from tests.test_scope_import import _scope_row, _workbook
+
+_JOB_URL_RE = re.compile(r'hx-get="([^"]+/jobs/[^"]+)"')
+
+
+async def _web_login(client, email, password="secret123"):
+    resp = await client.post("/login", data={"email": email, "password": password})
+    assert resp.status_code == 303
+
+
+async def _poll_until_done(client, url, max_tries=50):
+    """Follow the same htmx polling loop a browser would, until no further
+    ``hx-get`` job-status link is present in the response."""
+    body = ""
+    for _ in range(max_tries):
+        resp = await client.get(url)
+        assert resp.status_code == 200
+        body = resp.text
+        match = _JOB_URL_RE.search(body)
+        if not match:
+            return body
+        url = match.group(1)
+        await asyncio.sleep(0.02)
+    raise AssertionError(f"job did not finish after {max_tries} polls: {body!r}")
+
+
+@pytest.mark.asyncio
+async def test_scope_import_runs_in_background(
+    client, seeded, make_user, db_sessionmaker, monkeypatch
+):
+    monkeypatch.setattr("app.web.admin.AsyncSessionLocal", db_sessionmaker)
+    async with db_sessionmaker() as db:
+        perms = seeded["perms"]
+        editor = await role_crud.create(
+            db,
+            name="scope-import-editor",
+            permission_ids=[perms["augmented_parts:write"].id],
+        )
+        editor_id = editor.id
+    await make_user("importer@example.com", role_ids=[editor_id])
+    await _web_login(client, "importer@example.com")
+
+    data = _workbook([_scope_row(product_number="BG-SCOPE-1")])
+    resp = await client.post(
+        "/admin/scope-import",
+        files={"file": ("scopes.xlsx", data, "application/octet-stream")},
+    )
+    assert resp.status_code == 200
+    assert "scope-import-status" in resp.text
+    match = _JOB_URL_RE.search(resp.text)
+    assert match, resp.text
+
+    final_body = await _poll_until_done(client, match.group(1))
+    assert "1</strong> created" in final_body
+
+
+@pytest.mark.asyncio
+async def test_augmented_parts_sync_runs_in_background(
+    client, seeded, make_user, db_sessionmaker, monkeypatch
+):
+    monkeypatch.setattr("app.web.admin.AsyncSessionLocal", db_sessionmaker)
+    async with db_sessionmaker() as db:
+        perms = seeded["perms"]
+        editor = await role_crud.create(
+            db, name="sync-editor", permission_ids=[perms["augmented_parts:write"].id]
+        )
+        editor_id = editor.id
+    await make_user("syncer@example.com", role_ids=[editor_id])
+    await _web_login(client, "syncer@example.com")
+
+    resp = await client.post("/admin/augmented-parts/sync")
+    assert resp.status_code == 200
+    assert 'id="augmented-part-list"' in resp.text
+    match = _JOB_URL_RE.search(resp.text)
+    assert match, resp.text
+
+    final_body = await _poll_until_done(client, match.group(1))
+    assert "Sync complete" in final_body
+
+
+@pytest.mark.asyncio
+async def test_fit_recompute_for_part_runs_in_background(
+    client, seeded, make_user, db_sessionmaker, monkeypatch
+):
+    monkeypatch.setattr("app.web.admin.AsyncSessionLocal", db_sessionmaker)
+    async with db_sessionmaker() as db:
+        apn = AttachmentPointName(name="Objective")
+        part_t = PartType(name="Scope")
+        db.add_all([apn, part_t])
+        await db.flush()
+        part = AugmentedPart(
+            description="Test scope",
+            colour_id=1,
+            manufacturer_id=1,
+            part_type_id=part_t.id,
+        )
+        db.add(part)
+        await db.flush()
+        db.add(
+            AttachmentPoint(augmented_part_id=part.id, attachment_point_name_id=apn.id)
+        )
+        await db.commit()
+        part_id = part.id
+
+        perms = seeded["perms"]
+        editor = await role_crud.create(
+            db,
+            name="fit-recompute-editor",
+            permission_ids=[perms["fits:write"].id, perms["augmented_parts:read"].id],
+        )
+        editor_id = editor.id
+    await make_user("recomputer@example.com", role_ids=[editor_id])
+    await _web_login(client, "recomputer@example.com")
+
+    resp = await client.post(f"/admin/augmented-parts/{part_id}/fits/recompute")
+    assert resp.status_code == 200
+    assert f'id="ap-{part_id}-fits"' in resp.text
+    match = _JOB_URL_RE.search(resp.text)
+    assert match, resp.text
+
+    final_body = await _poll_until_done(client, match.group(1))
+    assert "created" in final_body and "removed" in final_body
+
+
+@pytest.mark.asyncio
+async def test_fit_recompute_all_runs_in_background(
+    client, seeded, make_user, db_sessionmaker, monkeypatch
+):
+    monkeypatch.setattr("app.web.admin.AsyncSessionLocal", db_sessionmaker)
+    async with db_sessionmaker() as db:
+        perms = seeded["perms"]
+        editor = await role_crud.create(
+            db, name="fit-recompute-all-editor", permission_ids=[perms["fits:write"].id]
+        )
+        editor_id = editor.id
+    await make_user("recomputerall@example.com", role_ids=[editor_id])
+    await _web_login(client, "recomputerall@example.com")
+
+    resp = await client.post("/admin/augmented-parts/fits/recompute")
+    assert resp.status_code == 200
+    assert "fits-recompute-status" in resp.text
+    match = _JOB_URL_RE.search(resp.text)
+    assert match, resp.text
+
+    final_body = await _poll_until_done(client, match.group(1))
+    assert "Recompute complete" in final_body

tests/test_admin_sorting.py

@@ -0,0 +1,148 @@
+import pytest
+
+from app.crud import augmented_part as augmented_part_crud
+from app.models.augmented_part import AugmentedPart
+from app.models.imported_part import ImportedPart
+from app.models.manufacturer import Manufacturer
+from app.models.part_colour import PartColour
+from app.models.part_type import PartType
+
+
+async def _web_login(client, email, password="secret123"):
+    resp = await client.post("/login", data={"email": email, "password": password})
+    assert resp.status_code == 303
+
+
+async def _seed_augmented_parts(db):
+    part_t = PartType(name="Scope")
+    db.add(part_t)
+    await db.flush()
+    parts = [
+        AugmentedPart(
+            description=desc,
+            sku=sku,
+            colour_id=1,
+            manufacturer_id=1,
+            part_type_id=part_t.id,
+        )
+        for desc, sku in [
+            ("Alpha scope", "SKU-C"),
+            ("Bravo scope", "SKU-A"),
+            ("Charlie scope", "SKU-B"),
+        ]
+    ]
+    db.add_all(parts)
+    await db.commit()
+
+
+async def _seed_imported_parts(db):
+    db.add_all(
+        [
+            ImportedPart(InventoryID="INV-2", Description="Charlie widget"),
+            ImportedPart(InventoryID="INV-1", Description="Alpha widget"),
+            ImportedPart(InventoryID="INV-3", Description="Bravo widget"),
+        ]
+    )
+    await db.commit()
+
+
+def _order_of(body: str, needles: list[str]) -> list[str]:
+    positions = {n: body.find(n) for n in needles}
+    return sorted(positions, key=lambda n: positions[n])
+
+
+@pytest.mark.asyncio
+async def test_augmented_parts_page_sorts_by_description_desc(
+    client, seeded, make_user, db_sessionmaker
+):
+    async with db_sessionmaker() as db:
+        await _seed_augmented_parts(db)
+    await make_user("reader@example.com", role_ids=[seeded["roles"]["user"].id])
+    await _web_login(client, "reader@example.com")
+
+    resp = await client.get("/admin/augmented-parts?sort=description&dir=desc")
+    assert resp.status_code == 200
+    body = resp.text
+    assert _order_of(body, ["Charlie scope", "Bravo scope", "Alpha scope"]) == [
+        "Charlie scope",
+        "Bravo scope",
+        "Alpha scope",
+    ]
+
+
+@pytest.mark.asyncio
+async def test_augmented_parts_filter_sorts_by_sku_asc(
+    client, seeded, make_user, db_sessionmaker
+):
+    async with db_sessionmaker() as db:
+        await _seed_augmented_parts(db)
+    await make_user("reader2@example.com", role_ids=[seeded["roles"]["user"].id])
+    await _web_login(client, "reader2@example.com")
+
+    resp = await client.get("/admin/augmented-parts/filter?sort=sku&dir=asc")
+    assert resp.status_code == 200
+    body = resp.text
+    # SKU-A (Bravo), SKU-B (Charlie), SKU-C (Alpha)
+    assert _order_of(body, ["Bravo scope", "Charlie scope", "Alpha scope"]) == [
+        "Bravo scope",
+        "Charlie scope",
+        "Alpha scope",
+    ]
+
+
+@pytest.mark.asyncio
+async def test_imported_parts_page_sorts_by_description_desc(
+    client, seeded, make_user, db_sessionmaker
+):
+    async with db_sessionmaker() as db:
+        await _seed_imported_parts(db)
+    await make_user("reader3@example.com", role_ids=[seeded["roles"]["user"].id])
+    await _web_login(client, "reader3@example.com")
+
+    resp = await client.get("/admin/imported-parts?sort=Description&dir=desc")
+    assert resp.status_code == 200
+    body = resp.text
+    assert _order_of(body, ["Charlie widget", "Bravo widget", "Alpha widget"]) == [
+        "Charlie widget",
+        "Bravo widget",
+        "Alpha widget",
+    ]
+
+
+@pytest.mark.asyncio
+async def test_list_filtered_sorts_by_joined_colour_name(db_sessionmaker):
+    async with db_sessionmaker() as db:
+        red = PartColour(name="Red")
+        blue = PartColour(name="Blue")
+        manufacturer = Manufacturer(name="Acme", url="https://acme.example")
+        part_t = PartType(name="Scope")
+        db.add_all([red, blue, manufacturer, part_t])
+        await db.flush()
+
+        db.add_all(
+            [
+                AugmentedPart(
+                    description="Red one",
+                    colour_id=red.id,
+                    manufacturer_id=manufacturer.id,
+                    part_type_id=part_t.id,
+                ),
+                AugmentedPart(
+                    description="Blue one",
+                    colour_id=blue.id,
+                    manufacturer_id=manufacturer.id,
+                    part_type_id=part_t.id,
+                ),
+            ]
+        )
+        await db.commit()
+
+        parts = await augmented_part_crud.list_filtered(
+            db, sort="colour", direction="asc"
+        )
+        assert [p.description for p in parts] == ["Blue one", "Red one"]
+
+        parts_desc = await augmented_part_crud.list_filtered(
+            db, sort="colour", direction="desc"
+        )
+        assert [p.description for p in parts_desc] == ["Red one", "Blue one"]

tests/test_augmented_part_detail.py

@@ -3,8 +3,9 @@ import pytest
 from app.crud import role as role_crud
 from app.models.attachment_point import AttachmentPoint
 from app.models.attachment_point_name import AttachmentPointName
-from app.models.augmented_part import AugmentedPart
+from app.models.augmented_part import AugmentedPart, AugmentedPartNote
-from app.models.fit import Fit, FitLabel
+from app.models.fit import Fit, FitLabel, FitNote
+from app.models.iso_thread import IsoThread
 from app.models.part_type import PartType
 from app.models.scope_info import ScopeInfo
 
@@ -40,12 +41,8 @@ async def _seed_part_with_fit(db):
             objective_thread_pitch="M52x0.75",
         )
     )
-    ap_s = AttachmentPoint(
+    ap_s = AttachmentPoint(augmented_part_id=scope.id, attachment_point_name_id=apn.id)
-        augmented_part_id=scope.id, attachment_point_name_id=apn.id
+    ap_c = AttachmentPoint(augmented_part_id=cover.id, attachment_point_name_id=apn.id)
-    )
-    ap_c = AttachmentPoint(
-        augmented_part_id=cover.id, attachment_point_name_id=apn.id
-    )
     db.add_all([ap_s, ap_c])
     await db.flush()
 
@@ -91,6 +88,37 @@ async def test_detail_shows_attributes_and_fits_readonly(
     assert "Add fit" not in body
     assert "Mark Exact" not in body
     assert "Recompute possible fits" not in body
+    assert "Add note" not in body
+    # ...and attachment-point add/edit/delete controls are hidden too
+    assert 'name="attachment_point_name_id"' not in body
+    assert "Delete this attachment point?" not in body
+
+
+@pytest.mark.asyncio
+async def test_detail_write_controls_for_attachment_point_editor(
+    client, seeded, make_user, db_sessionmaker
+):
+    async with db_sessionmaker() as db:
+        ids = await _seed_part_with_fit(db)
+        perms = seeded["perms"]
+        editor = await role_crud.create(
+            db,
+            name="ap-editor",
+            permission_ids=[
+                perms["augmented_parts:read"].id,
+                perms["attachment_points:read"].id,
+                perms["attachment_points:write"].id,
+            ],
+        )
+        editor_id = editor.id
+    await make_user("apeditor@example.com", role_ids=[editor_id])
+    await _web_login(client, "apeditor@example.com")
+
+    resp = await client.get(f"/admin/augmented-parts/{ids['scope_id']}")
+    assert resp.status_code == 200
+    body = resp.text
+    assert 'name="attachment_point_name_id"' in body
+    assert "Delete this attachment point?" in body
 
 
 @pytest.mark.asyncio
@@ -121,6 +149,199 @@ async def test_detail_write_controls_for_fit_editor(
     assert "Recompute possible fits" in body
 
 
+@pytest.mark.asyncio
+async def test_create_fit_auto_creates_matching_attachment_point(
+    client, seeded, make_user, db_sessionmaker
+):
+    async with db_sessionmaker() as db:
+        apn = AttachmentPointName(name="Objective")
+        scope_t = PartType(name="Scope")
+        cover_t = PartType(name="Flip Cover")
+        db.add_all([apn, scope_t, cover_t])
+        await db.flush()
+
+        thread = IsoThread(diameter_mm=42.0, pitch_mm=0.75)
+        db.add(thread)
+        await db.flush()
+
+        scope = AugmentedPart(
+            description="Alpha 3-18x50",
+            sku="ALP-318",
+            colour_id=1,
+            manufacturer_id=1,
+            part_type_id=scope_t.id,
+        )
+        cover = AugmentedPart(
+            description="Flip cover 50mm",
+            colour_id=1,
+            manufacturer_id=1,
+            part_type_id=cover_t.id,
+        )
+        db.add_all([scope, cover])
+        await db.flush()
+
+        own_ap = AttachmentPoint(
+            augmented_part_id=scope.id,
+            attachment_point_name_id=apn.id,
+            iso_thread_id=thread.id,
+        )
+        db.add(own_ap)
+        await db.commit()
+
+        scope_id, cover_id, own_ap_id = scope.id, cover.id, own_ap.id
+
+        perms = seeded["perms"]
+        editor = await role_crud.create(
+            db,
+            name="fit-editor2",
+            permission_ids=[
+                perms["augmented_parts:read"].id,
+                perms["fits:read"].id,
+                perms["fits:write"].id,
+            ],
+        )
+        editor_id = editor.id
+    await make_user("editor2@example.com", role_ids=[editor_id])
+    await _web_login(client, "editor2@example.com")
+
+    resp = await client.post(
+        f"/admin/augmented-parts/{scope_id}/fits",
+        data={
+            "own_attachment_point_id": own_ap_id,
+            "other_augmented_part_id": cover_id,
+            "other_attachment_point_id": "",
+            "label": "possible",
+        },
+    )
+    assert resp.status_code == 200
+    body = resp.text
+    assert "already exists" not in body
+    assert "not found" not in body
+
+    async with db_sessionmaker() as db:
+        cover_points = [
+            ap
+            for ap in (await db.execute(AttachmentPoint.__table__.select())).all()
+            if ap.augmented_part_id == cover_id
+        ]
+        assert len(cover_points) == 1
+        assert cover_points[0].iso_thread_id == thread.id
+        assert cover_points[0].attachment_point_name_id == apn.id
+
+        fits = (await db.execute(Fit.__table__.select())).all()
+        assert len(fits) == 1
+        assert fits[0].label == FitLabel.POSSIBLE
+
+
+@pytest.mark.asyncio
+async def test_create_fit_with_note_creates_fit_note(
+    client, seeded, make_user, db_sessionmaker
+):
+    async with db_sessionmaker() as db:
+        apn = AttachmentPointName(name="Objective")
+        scope_t = PartType(name="Scope")
+        cover_t = PartType(name="Flip Cover")
+        db.add_all([apn, scope_t, cover_t])
+        await db.flush()
+
+        scope = AugmentedPart(
+            description="Alpha 3-18x50",
+            sku="ALP-318",
+            colour_id=1,
+            manufacturer_id=1,
+            part_type_id=scope_t.id,
+        )
+        cover = AugmentedPart(
+            description="Flip cover 50mm",
+            colour_id=1,
+            manufacturer_id=1,
+            part_type_id=cover_t.id,
+        )
+        db.add_all([scope, cover])
+        await db.flush()
+
+        own_ap = AttachmentPoint(
+            augmented_part_id=scope.id, attachment_point_name_id=apn.id
+        )
+        other_ap = AttachmentPoint(
+            augmented_part_id=cover.id, attachment_point_name_id=apn.id
+        )
+        db.add_all([own_ap, other_ap])
+        await db.commit()
+
+        scope_id, own_ap_id, other_ap_id = scope.id, own_ap.id, other_ap.id
+
+        perms = seeded["perms"]
+        editor = await role_crud.create(
+            db,
+            name="fit-editor3",
+            permission_ids=[
+                perms["augmented_parts:read"].id,
+                perms["fits:read"].id,
+                perms["fits:write"].id,
+            ],
+        )
+        editor_id = editor.id
+    await make_user("editor3@example.com", role_ids=[editor_id])
+    await _web_login(client, "editor3@example.com")
+
+    resp = await client.post(
+        f"/admin/augmented-parts/{scope_id}/fits",
+        data={
+            "own_attachment_point_id": own_ap_id,
+            "other_attachment_point_id": other_ap_id,
+            "label": "exact",
+            "note": "Confirmed fit on the bench.",
+        },
+    )
+    assert resp.status_code == 200
+    body = resp.text
+    assert "Confirmed fit on the bench." in body
+
+    async with db_sessionmaker() as db:
+        fits = (await db.execute(Fit.__table__.select())).all()
+        assert len(fits) == 1
+        notes = (await db.execute(FitNote.__table__.select())).all()
+        assert len(notes) == 1
+        assert notes[0].fit_id == fits[0].id
+        assert notes[0].body == "Confirmed fit on the bench."
+
+
+@pytest.mark.asyncio
+async def test_create_augmented_part_note(client, seeded, make_user, db_sessionmaker):
+    async with db_sessionmaker() as db:
+        ids = await _seed_part_with_fit(db)
+        perms = seeded["perms"]
+        editor = await role_crud.create(
+            db,
+            name="ap-note-editor",
+            permission_ids=[
+                perms["augmented_parts:read"].id,
+                perms["augmented_parts:write"].id,
+            ],
+        )
+        editor_id = editor.id
+    await make_user("noteeditor@example.com", role_ids=[editor_id])
+    await _web_login(client, "noteeditor@example.com")
+
+    resp = await client.get(f"/admin/augmented-parts/{ids['scope_id']}")
+    assert resp.status_code == 200
+    assert "Add note" in resp.text
+
+    resp = await client.post(
+        f"/admin/augmented-parts/{ids['scope_id']}/notes",
+        data={"body": "Verified thread depth on the bench."},
+    )
+    assert resp.status_code == 200
+    assert "Verified thread depth on the bench." in resp.text
+
+    async with db_sessionmaker() as db:
+        notes = (await db.execute(AugmentedPartNote.__table__.select())).all()
+        assert len(notes) == 1
+        assert notes[0].augmented_part_id == ids["scope_id"]
+        assert notes[0].body == "Verified thread depth on the bench."
+
+
 @pytest.mark.asyncio
 async def test_detail_404_for_missing_part(client, seeded, make_user):
     await make_user("reader2@example.com", role_ids=[seeded["roles"]["user"].id])
@@ -130,7 +351,9 @@ async def test_detail_404_for_missing_part(client, seeded, make_user):
 
 
 @pytest.mark.asyncio
-async def test_detail_requires_read_permission(client, seeded, make_user, db_sessionmaker):
+async def test_detail_requires_read_permission(
+    client, seeded, make_user, db_sessionmaker
+):
     async with db_sessionmaker() as db:
         ids = await _seed_part_with_fit(db)
     await make_user("plain@example.com")  # no roles, not superuser

tests/test_login_redirect.py

@@ -0,0 +1,73 @@
+import pytest
+
+
+@pytest.mark.asyncio
+async def test_deep_link_redirects_to_login_with_next(client):
+    resp = await client.get("/scopes")
+    assert resp.status_code == 302
+    assert resp.headers["location"] == "/login?next=%2Fscopes"
+
+
+@pytest.mark.asyncio
+async def test_deep_link_preserves_query_string(client):
+    resp = await client.get("/scopes?description=alpha")
+    assert resp.status_code == 302
+    assert resp.headers["location"] == "/login?next=%2Fscopes%3Fdescription%3Dalpha"
+
+
+@pytest.mark.asyncio
+async def test_root_redirect_has_no_next(client):
+    resp = await client.get("/")
+    assert resp.status_code == 302
+    assert resp.headers["location"] == "/login"
+
+
+@pytest.mark.asyncio
+async def test_login_page_renders_next_field(client):
+    resp = await client.get("/login?next=/scopes")
+    assert resp.status_code == 200
+    assert 'name="next" value="/scopes"' in resp.text
+
+
+@pytest.mark.asyncio
+async def test_login_redirects_to_next_on_success(client, make_user):
+    await make_user("u@example.com")
+    resp = await client.post(
+        "/login",
+        data={"email": "u@example.com", "password": "secret123", "next": "/scopes"},
+    )
+    assert resp.status_code == 303
+    assert resp.headers["location"] == "/scopes"
+
+
+@pytest.mark.asyncio
+async def test_login_defaults_to_root_without_next(client, make_user):
+    await make_user("u2@example.com")
+    resp = await client.post(
+        "/login", data={"email": "u2@example.com", "password": "secret123"}
+    )
+    assert resp.status_code == 303
+    assert resp.headers["location"] == "/"
+
+
+@pytest.mark.asyncio
+async def test_login_rejects_unsafe_next(client, make_user):
+    await make_user("u3@example.com")
+    for bad in ["https://evil.com", "//evil.com", "/\\evil.com", "/login"]:
+        resp = await client.post(
+            "/login",
+            data={"email": "u3@example.com", "password": "secret123", "next": bad},
+        )
+        assert resp.status_code == 303
+        assert resp.headers["location"] == "/", bad
+
+
+@pytest.mark.asyncio
+async def test_failed_login_preserves_next(client, make_user):
+    await make_user("u4@example.com")
+    resp = await client.post(
+        "/login",
+        data={"email": "u4@example.com", "password": "wrong", "next": "/scopes"},
+    )
+    assert resp.status_code == 401
+    assert 'name="next" value="/scopes"' in resp.text

tests/test_scope_guide.py

@@ -238,4 +238,5 @@ async def test_scopes_page_forbidden_without_permission(client, seeded, make_use
 async def test_scopes_page_redirects_when_anonymous(client):
     resp = await client.get("/scopes")
     assert resp.status_code == 302
-    assert resp.headers["location"] == "/login"
+    # Deep link is preserved so the user lands back here after logging in.
+    assert resp.headers["location"] == "/login?next=%2Fscopes"