operatore: acquisizione immagine, proxy execute e overlay per camera_measure/dxf_compare (#46)

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

src/frontend/flask_app/blueprints/auth.py

@@ -59,45 +59,6 @@ def _post_login_landing():
     return url_for("auth.profile")
 
 
-def _complete_login(response, fallback_name):
-    """Dopo una risposta di login riuscita: sessione, preferenze, impostazioni (#59).
-
-    Comune al login con password e al login con PIN, cosi' i due restano identici.
-    Ritorna l'utente salvato in sessione.
-    """
-    # Salva in sessione. permanent=True fa valere PERMANENT_SESSION_LIFETIME
-    # (8h, config.py): senza, Flask usa una sessione di durata browser e il
-    # limite configurato non ha mai effetto (#33).
-    session.permanent = True
-    session["api_key"] = response["api_key"]
-    session["user"] = response["user"]
-    session["user_id"] = response["user"]["id"]
-
-    # Applica preferenze utente
-    user = response["user"]
-    if user.get("language_pref"):
-        session["language"] = user["language_pref"]
-    if user.get("theme_pref"):
-        session["theme"] = user["theme_pref"]
-
-    # Carica impostazioni di sistema
-    settings_resp = api_client.get("/api/settings")
-    if not settings_resp.get("error"):
-        logo_path = settings_resp.get("company_logo_path")
-        if logo_path:
-            session["company_logo"] = logo_path
-        auto_logout = settings_resp.get("auto_logout_minutes")
-        if auto_logout:
-            try:
-                session["auto_logout_minutes"] = int(auto_logout)
-            except (ValueError, TypeError):
-                pass
-
-    flash(_("Benvenuto, %(name)s!", name=user.get("display_name", fallback_name)), "success")
-
-    return user
-
-
 @auth_bp.route("/login", methods=["GET", "POST"])
 def login():
     """Login page and form handler."""
@@ -120,7 +81,35 @@ def login():
                 flash(response.get("detail", _("Credenziali non valide")), "error")
                 return render_template("auth/login.html")
 
-            user = _complete_login(response, username)
+            # Salva in sessione. permanent=True fa valere PERMANENT_SESSION_LIFETIME
+            # (8h, config.py): senza, Flask usa una sessione di durata browser e il
+            # limite configurato non ha mai effetto (#33).
+            session.permanent = True
+            session["api_key"] = response["api_key"]
+            session["user"] = response["user"]
+            session["user_id"] = response["user"]["id"]
+
+            # Applica preferenze utente
+            user = response["user"]
+            if user.get("language_pref"):
+                session["language"] = user["language_pref"]
+            if user.get("theme_pref"):
+                session["theme"] = user["theme_pref"]
+
+            # Carica impostazioni di sistema
+            settings_resp = api_client.get("/api/settings")
+            if not settings_resp.get("error"):
+                logo_path = settings_resp.get("company_logo_path")
+                if logo_path:
+                    session["company_logo"] = logo_path
+                auto_logout = settings_resp.get("auto_logout_minutes")
+                if auto_logout:
+                    try:
+                        session["auto_logout_minutes"] = int(auto_logout)
+                    except (ValueError, TypeError):
+                        pass
+
+            flash(_("Benvenuto, %(name)s!", name=user.get("display_name", username)), "success")
 
             # Redirect dopo login (in base al ruolo)
             return redirect(_post_login_landing())
@@ -132,55 +121,6 @@ def login():
     return render_template("auth/login.html")
 
 
-@auth_bp.route("/pin-users", methods=["GET"])
-def pin_users():
-    """Elenco nomi per la vista Operatore del login (#59): solo id e nome.
-
-    Pubblica come il login; se il backend non risponde o non ha il PIN, lista
-    vuota e la pagina apre il form password.
-    """
-    if session.get("api_key"):
-        return jsonify([])
-    try:
-        resp = api_client.get("/api/auth/pin-users")
-    except Exception:
-        return jsonify([])
-    if not isinstance(resp, list):
-        return jsonify([])
-    return jsonify([
-        {"id": u.get("id"), "display_name": u.get("display_name", "")}
-        for u in resp if isinstance(u, dict)
-    ])
-
-
-@auth_bp.route("/login-pin", methods=["POST"])
-def login_pin():
-    """Login con nome + PIN (#59). JSON in/out; CSRF come il login password
-    (header X-CSRFToken, gestito da CSRFProtect)."""
-    data = request.get_json(silent=True) or {}
-    user_id = data.get("user_id")
-    pin = str(data.get("pin", ""))
-    if not isinstance(user_id, int) or not (len(pin) == 4 and pin.isdigit()):
-        return jsonify({"error": True, "status_code": 422, "detail": _("Il PIN deve essere di 4 cifre")}), 422
-
-    try:
-        response = api_client.post("/api/auth/login-pin", data={"user_id": user_id, "pin": pin})
-    except Exception as e:
-        return jsonify({"error": True, "status_code": 502,
-                        "detail": _("Errore di connessione al server: %(error)s", error=str(e))}), 502
-
-    if response.get("error"):
-        status = response.get("status_code") or 401
-        if status == 401:
-            detail = _("PIN errato")
-        else:
-            detail = response.get("detail") or _("Credenziali non valide")
-        return jsonify({"error": True, "status_code": status, "detail": detail}), status
-
-    _complete_login(response, "")  # include il flash di benvenuto
-    return jsonify({"ok": True, "redirect": _post_login_landing()})
-
-
 @auth_bp.route("/logout", methods=["POST"])
 def logout():
     """Clear session and redirect to login."""

src/frontend/flask_app/blueprints/measure.py

@@ -1,8 +1,10 @@
 """MeasurementTec blueprint - recipe selection and measurement execution."""
 import urllib.parse
 
+import requests as http_requests
+
 from flask import (
-    Blueprint, abort, flash, jsonify, redirect, render_template,
+    Blueprint, Response, abort, flash, jsonify, redirect, render_template,
     request, session, url_for,
 )
 from flask_babel import gettext as _
@@ -820,3 +822,67 @@ def api_close_production(run_id: int):
 def api_get_file(file_path: str):
     """Proxy: Serve file from API server (browser can't send X-API-Key)."""
     return proxy_file(file_path)
+
+
+# ---------------------------------------------------------------------------
+# Route: vision execute (#46) - the browser sends an image, we relay it to
+# POST /api/vision/execute (multipart) because it cannot send X-API-Key itself.
+# ---------------------------------------------------------------------------
+@measure_bp.route("/api/vision/execute", methods=["POST"])
+@login_required
+@role_required("MeasurementTec")
+def api_vision_execute():
+    """Proxy: run the task's VisionSuite recipe on the uploaded image."""
+    image = request.files.get("image")
+    task_id = request.form.get("task_id")
+    if image is None or not task_id:
+        return jsonify({
+            "error": True,
+            "detail": _("Dati mancanti: task_id e image sono obbligatori"),
+        }), 400
+
+    # Same context fields as the manual flow; empty ones are left out so the
+    # backend sees them as absent rather than as "".
+    form = {"task_id": task_id}
+    for key in ("task_type", "lot_number", "serial_number", "production_run_id"):
+        val = request.form.get(key)
+        if val:
+            form[key] = val
+    form.setdefault("lot_number", session.get("lot_number", ""))
+    form.setdefault("serial_number", session.get("serial_number", ""))
+
+    resp = api_client.post(
+        "/api/vision/execute",
+        data=form,
+        files={"image": (
+            image.filename or "capture.jpg",
+            image.read(),
+            image.mimetype or "application/octet-stream",
+        )},
+    )
+    if resp.get("error"):
+        status_code = resp.get("status_code", 500)
+        body = {"error": True, "detail": resp.get("detail", _("Errore nell'esecuzione"))}
+        if resp.get("session_expired"):
+            body["session_expired"] = True
+        return jsonify(body), status_code if status_code >= 400 else 500
+    return jsonify(resp), 200
+
+
+@measure_bp.route("/api/vision/results/<int:result_id>/image", methods=["GET"])
+@login_required
+@role_required("MeasurementTec")
+def api_vision_result_image(result_id: int):
+    """Proxy: the image saved with a vision result (needs X-API-Key)."""
+    base_url = Config.API_SERVER_URL.rstrip("/")
+    resp = http_requests.get(
+        f"{base_url}/api/vision/results/{result_id}/image",
+        headers={"X-API-Key": session.get("api_key", "")},
+        timeout=30,
+    )
+    if resp.status_code != 200:
+        return Response(resp.text, status=resp.status_code)
+    return Response(
+        resp.content,
+        content_type=resp.headers.get("content-type", "application/octet-stream"),
+    )

src/frontend/flask_app/static/js/pin-pad.js

@@ -1,60 +0,0 @@
-/* Login Operatore: nome + PIN a 4 cifre (#59).
- * Componente Alpine globale `pinLogin()`, usato da templates/auth/login.html.
- * Contratto: GET /auth/pin-users -> [{id, display_name}];
- * POST /auth/login-pin {user_id, pin} -> {ok, redirect} | {error, detail}. */
-function pinLogin() {
-  return {
-    mode: 'pin',        // vista Operatore di default; se l'elenco e' vuoto/fallisce passa a 'password'
-    users: [],
-    selected: null,
-    pin: '',
-    error: '',
-    busy: false,
-
-    init: function () {
-      var self = this;
-      fetch(window.TMF_PIN.usersUrl, { headers: { 'Accept': 'application/json' } })
-        .then(function (r) { return r.ok ? r.json() : []; })
-        .then(function (list) {
-          self.users = Array.isArray(list) ? list : [];
-          if (!self.users.length) self.mode = 'password';  // elenco vuoto: form password
-        })
-        .catch(function () { self.users = []; self.mode = 'password'; });
-    },
-    select: function (u) { this.selected = u; this.pin = ''; this.error = ''; },
-    back: function () { this.selected = null; this.pin = ''; this.error = ''; },
-    del: function () { this.pin = this.pin.slice(0, -1); },
-    press: function (d) {
-      if (this.busy || this.pin.length >= 4) return;
-      this.pin += d;
-      this.error = '';
-      if (this.pin.length === 4) this.submit();  // invio automatico alla quarta cifra
-    },
-    submit: function () {
-      var self = this;
-      var csrf = document.querySelector('meta[name=csrf-token]');
-      self.busy = true;
-      fetch(window.TMF_PIN.loginUrl, {
-        method: 'POST',
-        headers: {
-          'Content-Type': 'application/json',
-          'Accept': 'application/json',
-          'X-CSRFToken': (csrf && csrf.content) || ''
-        },
-        body: JSON.stringify({ user_id: self.selected.id, pin: self.pin })
-      })
-        .then(function (r) { return r.json().catch(function () { return {}; }); })
-        .then(function (d) {
-          if (d.ok && d.redirect) { window.location.href = d.redirect; return; }
-          self.error = d.detail || window.TMF_PIN.msgNet;  // 401 PIN errato, 423 blocco con ora
-          self.pin = '';
-          self.busy = false;
-        })
-        .catch(function () {
-          self.error = window.TMF_PIN.msgNet;
-          self.pin = '';
-          self.busy = false;
-        });
-    }
-  };
-}

src/frontend/flask_app/static/js/vision_execute.js

@@ -0,0 +1,125 @@
+/**
+ * Vision execute - Alpine component for camera_measure / dxf_compare tasks (#46).
+ *
+ * The operator takes (or picks) an image, `acquire(blob)` sends it to the Flask
+ * proxy, and the result - quote table, outcome, failures, overlay - is shown on
+ * the image. `acquire(blob)` is the single entry point on purpose: the agent
+ * camera (#3) will call it with its own blob and reuse everything below.
+ *
+ * Config comes from window.__visionCfg (set by the template):
+ *   executeUrl, imageUrlTpl (with a 0 placeholder for the result id), taskId,
+ *   taskType, subtasks, labels.
+ * Run context (lot, serial, production run) is read lazily through `ctx()`,
+ * which the template binds to the parent task component.
+ */
+function visionExecute() {
+  // Overlay colour per role (VisionSuite roles: reference, roi, found).
+  const ROLE_COLORS = { reference: '#2563eb', found: '#16a34a', roi: '#f59e0b' };
+
+  return {
+    busy: false,
+    error: '',
+    result: null,      // last execute response
+    imageSrc: '',      // object URL of the acquired image (shown under the overlay)
+    ctx: () => ({}),   // replaced by the template: {lot, serial, runId}
+
+    // Entry point shared with the future agent camera.
+    async acquire(blob) {
+      if (!blob || this.busy) return;
+      const cfg = window.__visionCfg || {};
+      this.busy = true;
+      this.error = '';
+      this.result = null;
+      // Show the picked image at once: the overlay is drawn on top when the result arrives.
+      if (this.imageSrc) URL.revokeObjectURL(this.imageSrc);
+      this.imageSrc = URL.createObjectURL(blob);
+      try {
+        const c = this.ctx() || {};
+        const fd = new FormData();
+        fd.append('task_id', cfg.taskId);
+        fd.append('task_type', cfg.taskType || '');
+        fd.append('image', blob, blob.name || 'capture.jpg');
+        fd.append('lot_number', c.lot || '');
+        fd.append('serial_number', c.serial || '');
+        if (c.runId) fd.append('production_run_id', c.runId);
+        const csrf = document.querySelector('meta[name=csrf-token]')?.content || '';
+        const resp = await fetch(cfg.executeUrl, {
+          method: 'POST', headers: { 'X-CSRFToken': csrf }, body: fd,
+        });
+        const body = await resp.json().catch(() => ({}));
+        if (!resp.ok || body.error) {
+          this.error = body.detail || (cfg.labels && cfg.labels.requestFailed) || 'Error';
+          return;
+        }
+        this.result = body;
+        // Draw once Alpine has rendered the canvas.
+        this.$nextTick(() => this.drawOverlay());
+      } catch (e) {
+        this.error = (cfg.labels && cfg.labels.requestFailed) || 'Error';
+      } finally {
+        this.busy = false;
+      }
+    },
+
+    // Input change: take the file and allow picking the same one again.
+    onPick(ev) {
+      const f = ev.target.files && ev.target.files[0];
+      ev.target.value = '';
+      if (f) this.acquire(f);
+    },
+
+    // Image shown: the saved one from the server when available, else the local one.
+    get shownImage() {
+      const cfg = window.__visionCfg || {};
+      if (this.result && this.result.vision_result_id && cfg.imageUrlTpl) {
+        return cfg.imageUrlTpl.replace('/0/', '/' + this.result.vision_result_id + '/');
+      }
+      return this.imageSrc;
+    },
+
+    // Quote rows: server measurements joined with the subtask names.
+    get rows() {
+      const cfg = window.__visionCfg || {};
+      const subs = cfg.subtasks || [];
+      return ((this.result && this.result.measurements) || []).map((m) => {
+        const st = subs.find((s) => s.id === m.subtask_id) || {};
+        return {
+          label: (st.marker_number ? st.marker_number + '. ' : '') + (st.measurement_type || st.name || '#' + m.subtask_id),
+          value: m.value,
+          unit: st.unit || 'mm',
+          status: m.pass_fail,
+        };
+      });
+    },
+
+    statusClass(s) {
+      // Same palette as the measurement markers of the manual flow.
+      if (s === 'pass') return 'bg-measure-pass/20 text-measure-pass border border-measure-pass/40';
+      if (s === 'fail') return 'bg-red-100 dark:bg-red-900/30 text-measure-fail border border-measure-fail/40';
+      if (s === 'warning') return 'bg-amber-100 dark:bg-amber-900/30 text-measure-warning border border-measure-warning/40';
+      return 'bg-[var(--bg-secondary)] text-[var(--text-muted)] border border-[var(--border-color)]';
+    },
+
+    // Canvas is sized to the natural image, so overlay coordinates (image px)
+    // are used as they are and CSS scales the whole thing to the displayed size.
+    drawOverlay() {
+      const img = this.$refs.img, cv = this.$refs.overlay;
+      if (!img || !cv || !img.naturalWidth) return;
+      cv.width = img.naturalWidth;
+      cv.height = img.naturalHeight;
+      const g = cv.getContext('2d');
+      g.clearRect(0, 0, cv.width, cv.height);
+      g.lineWidth = Math.max(2, cv.width / 400);
+      g.lineJoin = 'round';
+      for (const item of ((this.result && this.result.overlay) || [])) {
+        const rows = item.rows || [], cols = item.cols || [];
+        if (!rows.length || rows.length !== cols.length) continue;
+        g.strokeStyle = ROLE_COLORS[item.role] || '#ef4444';
+        g.beginPath();
+        g.moveTo(cols[0], rows[0]);
+        for (let i = 1; i < rows.length; i++) g.lineTo(cols[i], rows[i]);
+        g.stroke();
+      }
+    },
+  };
+}

src/frontend/flask_app/templates/auth/login.html

@@ -26,50 +26,8 @@
         </p>
       </div>
 
-      <div x-data="pinLogin()" x-init="init()">
-      <!-- Vista Operatore: nome + PIN (#59) -->
-      <div x-show="mode === 'pin'" x-cloak>
-        <!-- Elenco nomi -->
-        <div x-show="!selected">
-          <p class="text-sm text-center text-[var(--text-secondary)] mb-4">{{ _('Chi sei?') }}</p>
-          <div class="grid grid-cols-2 gap-3" id="pin-user-list">
-            <template x-for="u in users" :key="u.id">
-              <button type="button" @click="select(u)"
-                      class="btn btn-secondary min-h-[64px] text-base w-full" x-text="u.display_name"></button>
-            </template>
-          </div>
-        </div>
-        <!-- Tastierino -->
-        <div x-show="selected" id="pin-pad">
-          <p class="text-center font-semibold mb-1" x-text="selected && selected.display_name"></p>
-          <p class="text-sm text-center text-[var(--text-secondary)] mb-3">{{ _('Inserisci il PIN') }}</p>
-          <div class="flex justify-center gap-3 mb-3" aria-hidden="true">
-            <template x-for="i in 4" :key="i">
-              <span class="h-4 w-4 rounded-full border-2 border-[var(--border-color)]"
-                    :class="pin.length >= i ? 'bg-primary-600 border-primary-600' : ''"></span>
-            </template>
-          </div>
-          <p class="text-sm text-center text-red-600 min-h-[1.25rem] mb-2" role="alert" x-text="error"></p>
-          <div class="grid grid-cols-3 gap-3 max-w-xs mx-auto">
-            <template x-for="d in ['1','2','3','4','5','6','7','8','9']" :key="d">
-              <button type="button" @click="press(d)" :disabled="busy"
-                      class="btn btn-secondary h-16 min-w-[64px] text-2xl" x-text="d"></button>
-            </template>
-            <button type="button" @click="back()" :disabled="busy"
-                    class="btn btn-secondary h-16 min-w-[64px] text-sm">{{ _('Indietro') }}</button>
-            <button type="button" @click="press('0')" :disabled="busy"
-                    class="btn btn-secondary h-16 min-w-[64px] text-2xl">0</button>
-            <button type="button" @click="del()" :disabled="busy"
-                    class="btn btn-secondary h-16 min-w-[64px] text-sm">{{ _('Cancella') }}</button>
-          </div>
-        </div>
-        <p class="mt-6 text-center">
-          <a href="#" @click.prevent="mode = 'password'" class="text-sm text-primary-600 hover:underline">{{ _('Accedi con password') }}</a>
-        </p>
-      </div>
-
-      <!-- Login Form (password: admin e chi non ha PIN) -->
-      <form x-show="mode === 'password'" method="POST" action="{{ url_for('auth.login') }}" class="space-y-6">
+      <!-- Login Form -->
+      <form method="POST" action="{{ url_for('auth.login') }}" class="space-y-6">
         <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
         <!-- Username -->
         <div>
@@ -140,11 +98,6 @@
         </div>
       </form>
 
-      <p class="mt-4 text-center" x-show="mode === 'password' && users.length" x-cloak>
-        <a href="#" @click.prevent="mode = 'pin'" class="text-sm text-primary-600 hover:underline">{{ _('Accedi con PIN') }}</a>
-      </p>
-      </div>
-
       <!-- Help Text -->
       <div class="mt-6 text-center">
         <p class="text-xs text-[var(--text-muted)]">
@@ -162,15 +115,3 @@
   </div>
 </div>
 {% endblock %}
-
-{% block extra_js %}
-<script>
-  /* Configurazione e testi per pin-pad.js (#59) */
-  window.TMF_PIN = {
-    usersUrl: {{ url_for('auth.pin_users')|tojson }},
-    loginUrl: {{ url_for('auth.login_pin')|tojson }},
-    msgNet: {{ _('Errore di connessione al server')|tojson }}
-  };
-</script>
-<script src="{{ url_for('static', filename='js/pin-pad.js') }}"></script>
-{% endblock %}

src/frontend/flask_app/templates/measure/task_execute.html

@@ -191,7 +191,8 @@
   {# ================================================================
      MAIN — 3-column layout
      ================================================================ #}
-  <div class="flex-1 flex overflow-hidden">
+  {# #46: camera_measure / dxf_compare get the acquisition panel below instead of the manual layout #}
+  <div class="flex-1 flex overflow-hidden" x-show="!isVisionTask">
 
     {# ──────────────────────────────────────────────
        LEFT SIDEBAR — Marker list (vertical, hidden when no subtasks)
@@ -451,6 +452,63 @@
 
   </div>
 
+  {# ================================================================
+     VISION PANEL (#46) - acquire an image, run the recipe server-side, show the
+     quotes and the overlay. acquire(blob) is the entry point the agent camera
+     (#3) will reuse.
+     ================================================================ #}
+  <div x-show="isVisionTask" x-cloak
+       x-data="visionExecute()"
+       x-init="ctx = () => ({ lot: lotNumber, serial: serialNumber, runId: productionRun ? productionRun.id : null })"
+       class="flex-1 overflow-auto p-3 flex flex-col lg:flex-row gap-3">
+
+    <div class="flex-1 min-w-0 flex flex-col gap-2">
+      <div class="flex items-center gap-2 flex-wrap">
+        {# On a tablet this opens the camera; on a PC it picks a file. «Riprova» reuses the same input. #}
+        <label class="btn btn-primary text-sm gap-1.5 cursor-pointer" :class="busy ? 'opacity-50 pointer-events-none' : ''">
+          <span x-text="result ? '{{ _('Riprova') }}' : '{{ _('Acquisisci immagine') }}'"></span>
+          <input type="file" accept="image/*" capture="environment" class="hidden"
+                 @change="onPick($event)" :disabled="busy">
+        </label>
+        <span x-show="busy" class="text-sm text-[var(--text-muted)]">{{ _('Elaborazione in corso...') }}</span>
+      </div>
+
+      <div x-show="error" class="p-2 rounded-lg bg-red-50 dark:bg-red-900/20 border border-red-200 dark:border-red-800 text-sm text-measure-fail" x-text="error"></div>
+
+      <div x-show="shownImage" class="relative border border-[var(--border-color)] rounded-lg overflow-hidden bg-black/5">
+        <img x-ref="img" :src="shownImage" @load="drawOverlay()" alt="" class="block w-full h-auto">
+        <canvas x-ref="overlay" class="absolute inset-0 w-full h-full pointer-events-none"></canvas>
+      </div>
+      <div x-show="!shownImage" class="text-sm text-[var(--text-muted)]">
+        {{ _('Nessuna immagine acquisita: premi «Acquisisci immagine».') }}
+      </div>
+    </div>
+
+    <div class="lg:w-80 shrink-0 flex flex-col gap-2" x-show="result">
+      <div class="text-sm font-bold text-[var(--text-primary)]">
+        {{ _('Esito') }}: <span x-text="(result && result.outcome) || '-'"></span>
+      </div>
+
+      <table class="w-full text-sm" x-show="rows.length">
+        <template x-for="r in rows" :key="r.label">
+          <tr>
+            <td class="py-1 pr-2 text-[var(--text-secondary)]" x-text="r.label"></td>
+            <td class="py-1 pr-2 font-mono text-right" x-text="Number(r.value).toFixed(3) + ' ' + r.unit"></td>
+            <td class="py-1"><span class="inline-block px-2 py-0.5 rounded text-xs font-bold" :class="statusClass(r.status)" x-text="r.status"></span></td>
+          </tr>
+        </template>
+      </table>
+
+      <div x-show="result && result.failures && result.failures.length"
+           class="p-2 rounded-lg bg-amber-50 dark:bg-amber-900/20 border border-amber-300 dark:border-amber-700 text-xs">
+        <div class="font-bold mb-1">{{ _('Strumenti falliti') }}</div>
+        <template x-for="f in ((result && result.failures) || [])" :key="f.tool_id">
+          <div><span class="font-mono" x-text="f.tool_name || f.tool_id"></span>: <span x-text="f.error"></span></div>
+        </template>
+      </div>
+    </div>
+  </div>
+
   {# ================================================================
      MEASUREMENT TIMER BANNER
      ================================================================ #}
@@ -912,6 +970,18 @@
 <script src="{{ url_for('static', filename='js/numpad.js') }}"></script>
 <script src="{{ url_for('static', filename='js/annotation-viewer.js') }}?v=6"></script>
 <script src="{{ url_for('static', filename='js/caliper.js') }}"></script>
+{# #46: acquisition + overlay for camera_measure / dxf_compare #}
+<script>
+  window.__visionCfg = {
+    executeUrl: '{{ url_for("measure.api_vision_execute") }}',
+    imageUrlTpl: '{{ url_for("measure.api_vision_result_image", result_id=0) }}',
+    taskId: {{ task.id|tojson }},
+    taskType: {{ (task.task_type or '')|tojson }},
+    subtasks: window.__taskSubtasks,
+    labels: { requestFailed: {{ _('Richiesta non riuscita')|tojson }} },
+  };
+</script>
+<script src="{{ url_for('static', filename='js/vision_execute.js') }}"></script>
 {# The clock's rules - how a delay reads, when the buzzer goes, where the
    measurement lives - are shared with the other screens rather than restated. #}
 <script src="{{ url_for('static', filename='js/production-clock.js') }}"></script>
@@ -1776,6 +1846,12 @@ function taskExecute() {
       return declared === 'measure' || declared === 'camera_measure';
     },
 
+    /* #46: image-based tasks run a VisionSuite recipe on the server. */
+    get isVisionTask() {
+      const t = this.task.task_type;
+      return t === 'camera_measure' || t === 'dxf_compare';
+    },
+
     /* A measurement task with no quotes yet: the recipe is unfinished. Said out
        loud rather than silently rendering an empty screen. */
     get isMeasureTaskWithoutQuotes() {

src/frontend/flask_app/tests/test_auth.py

@@ -136,67 +136,3 @@ class TestLanguageSwitch:
         with client.session_transaction() as sess:
             # Invalid language should NOT be stored
             assert sess.get("language") != "xx"
-
-
-class TestPinLogin:
-    """Login Operatore con nome + PIN (#59)."""
-
-    USER = {
-        "id": 7, "username": "mario", "display_name": "Mario Rossi",
-        "roles": ["MeasurementTec"], "is_admin": False,
-        "language_pref": "it", "theme_pref": "light", "active": True,
-    }
-
-    def test_login_page_has_pin_view_and_password_link(self, client):
-        resp = client.get("/auth/login")
-        assert b"pin-pad.js" in resp.data
-        assert b"pin-pad" in resp.data  # tastierino presente nel markup
-        assert b'name="password"' in resp.data  # form password ancora presente
-
-    def test_pin_users_listed(self, client, mock_api_client):
-        mock_api_client.get.return_value = [
-            {"id": 7, "display_name": "Mario Rossi", "secret": "x"},
-        ]
-        resp = client.get("/auth/pin-users")
-        assert resp.status_code == 200
-        assert resp.get_json() == [{"id": 7, "display_name": "Mario Rossi"}]
-
-    def test_pin_users_empty_on_error(self, client, mock_api_client):
-        mock_api_client.get.return_value = {"error": True, "detail": "boom"}
-        assert client.get("/auth/pin-users").get_json() == []
-
-    def test_pin_users_empty_list_falls_back(self, client, mock_api_client):
-        mock_api_client.get.return_value = []
-        assert client.get("/auth/pin-users").get_json() == []
-
-    def test_login_pin_success_sets_session(self, client, mock_api_client):
-        mock_api_client.post.return_value = {"api_key": "pin-key", "user": self.USER}
-        mock_api_client.get.return_value = {}
-        resp = client.post("/auth/login-pin", json={"user_id": 7, "pin": "1234"})
-        assert resp.status_code == 200
-        assert resp.get_json()["ok"] is True
-        assert resp.get_json()["redirect"]
-        mock_api_client.post.assert_called_once_with(
-            "/api/auth/login-pin", data={"user_id": 7, "pin": "1234"})
-        with client.session_transaction() as sess:
-            assert sess["api_key"] == "pin-key"
-            assert sess["user_id"] == 7
-            assert sess.permanent is True
-
-    def test_login_pin_wrong_pin_401(self, client, mock_api_client):
-        mock_api_client.post.return_value = {"error": True, "status_code": 401, "detail": "x"}
-        resp = client.post("/auth/login-pin", json={"user_id": 7, "pin": "0000"})
-        assert resp.status_code == 401
-        assert resp.get_json()["detail"] == "PIN errato"
-
-    def test_login_pin_locked_423_shows_detail(self, client, mock_api_client):
-        mock_api_client.post.return_value = {
-            "error": True, "status_code": 423, "detail": "Utente bloccato fino alle 10:15"}
-        resp = client.post("/auth/login-pin", json={"user_id": 7, "pin": "0000"})
-        assert resp.status_code == 423
-        assert "10:15" in resp.get_json()["detail"]
-
-    def test_login_pin_invalid_pin_422(self, client, mock_api_client):
-        resp = client.post("/auth/login-pin", json={"user_id": 7, "pin": "12"})
-        assert resp.status_code == 422
-        mock_api_client.post.assert_not_called()

src/frontend/flask_app/tests/test_measure_vision.py

@@ -0,0 +1,86 @@
+"""gitea:Adriano/TieMeasureFlow#46 - operator side of the vision tasks.
+
+The backend of contract B is not merged yet: api_client is mocked.
+"""
+import io
+from unittest.mock import MagicMock, patch
+
+from tests.conftest import api_get_router
+
+TASK = {
+    "id": 12, "recipe_id": 3, "version_id": 5, "task_type": "camera_measure",
+    "title": "Foto", "directive": None, "description": None, "file_path": None,
+    "file_type": None, "annotations_json": None, "subtasks": [],
+}
+RECIPE = {
+    "id": 3, "code": "REC-1", "name": "Ricetta",
+    "measurement_interval_minutes": 30, "allow_manual_input": True,
+    "current_version": {"id": 5, "version_number": 1},
+}
+
+
+def test_execute_page_has_acquire_input(logged_in_client, mock_api_client, monkeypatch):
+    """camera_measure screen offers the file/camera input and the acquire entry point."""
+    monkeypatch.setattr("blueprints.measure.Config.STATION_CODE", "ST-TEST")
+    mock_api_client.get_station_recipes.return_value = {"items": [{"id": 3}]}
+    mock_api_client.get.side_effect = api_get_router({
+        "/api/tasks/12": TASK,
+        "/api/recipes/3/tasks": [{"id": 12, "order_index": 0}],
+        "/api/recipes/3": RECIPE,
+    })
+    html = logged_in_client.get("/measure/execute/12").get_data(as_text=True)
+    assert 'capture="environment"' in html
+    assert 'accept="image/*"' in html
+    assert "visionExecute()" in html
+    assert "/measure/api/vision/execute" in html
+
+
+def test_vision_execute_proxy_forwards_multipart(logged_in_client, mock_api_client):
+    mock_api_client.post.return_value = {
+        "vision_result_id": 7, "outcome": "ok", "overlay": [], "failures": [],
+        "measurements": [{"subtask_id": 1, "value": 9.9, "pass_fail": "pass"}],
+    }
+    resp = logged_in_client.post(
+        "/measure/api/vision/execute",
+        data={
+            "task_id": "12", "lot_number": "L1", "serial_number": "S1",
+            "production_run_id": "4",
+            "image": (io.BytesIO(b"\xff\xd8\xff fake"), "shot.jpg", "image/jpeg"),
+        },
+        content_type="multipart/form-data",
+    )
+    assert resp.status_code == 200
+    assert resp.get_json()["vision_result_id"] == 7
+    args, kwargs = mock_api_client.post.call_args
+    assert args[0] == "/api/vision/execute"
+    assert kwargs["data"]["task_id"] == "12"
+    assert kwargs["data"]["lot_number"] == "L1"
+    assert kwargs["data"]["production_run_id"] == "4"
+    name, content, mime = kwargs["files"]["image"]
+    assert name == "shot.jpg" and mime == "image/jpeg" and content.startswith(b"\xff\xd8")
+
+
+def test_vision_execute_proxy_requires_image(logged_in_client, mock_api_client):
+    resp = logged_in_client.post("/measure/api/vision/execute", data={"task_id": "12"})
+    assert resp.status_code == 400
+    mock_api_client.post.assert_not_called()
+
+
+def test_vision_execute_proxy_relays_backend_error(logged_in_client, mock_api_client):
+    mock_api_client.post.return_value = {"error": True, "status_code": 422, "detail": "bad"}
+    resp = logged_in_client.post(
+        "/measure/api/vision/execute",
+        data={"task_id": "12", "image": (io.BytesIO(b"x"), "a.jpg", "image/jpeg")},
+        content_type="multipart/form-data",
+    )
+    assert resp.status_code == 422
+    assert resp.get_json()["detail"] == "bad"
+
+
+def test_vision_result_image_proxy(logged_in_client):
+    fake = MagicMock(status_code=200, content=b"IMG", headers={"content-type": "image/jpeg"})
+    with patch("blueprints.measure.http_requests.get", return_value=fake) as g:
+        resp = logged_in_client.get("/measure/api/vision/results/7/image")
+    assert resp.status_code == 200 and resp.data == b"IMG"
+    assert g.call_args[0][0].endswith("/api/vision/results/7/image")
+    assert g.call_args[1]["headers"]["X-API-Key"] == "test-api-key-12345"