From 03a1151a5ae5f36d1c2cf70e13ab5b99194928dc Mon Sep 17 00:00:00 2001 From: cproudlock Date: Thu, 27 Aug 2026 15:12:07 -0400 Subject: [PATCH] Tech Tools is reachable by the people it was built for Every tool on that page is usable without an account, on purpose - the routes carry no requiresAuth and say so - and Secure Send is the one write this product offers a guest. The sidebar entry still never appeared for them: it named no permission, so the filter that decides what a signed-out visitor may see had nothing to go on and dropped it. The plugin had no read permission to name, only tools.secrets, so it gains tools.view: reaching the page at all. The tools themselves run in the browser and touch no data, which is why this is about whether the entry appears rather than about what anybody can read. The item names either right. Somebody granted only Secure Send needs the entry that leads to it, and a manager who holds neither still does not see it. --- CHANGELOG.md | 8 ++++++++ plugins/tools/plugin.py | 8 ++++++++ 2 files changed, 16 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index f70a7b34..0c1f1c05 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -115,6 +115,14 @@ ADR-007 and ADR-002. ### Fixed +- **Tech Tools was invisible to anyone without an account**, even though every + tool on the page is deliberately usable without one and Secure Send is the + single write this product offers a guest. The nav item named no permission, + because the plugin had none to name, so the sidebar filter dropped it. The + plugin gained `tools.view`, and the item now names either that or + `tools.secrets` - somebody granted only Secure Send still needs the entry + that leads to it. + - **The sidebar offered pages the reader could not open, and hid ones they could.** A nav item is hidden from anybody who does not hold its permission, but only four items ever declared one - so the filter did nothing for the diff --git a/plugins/tools/plugin.py b/plugins/tools/plugin.py index ce4dc055..463a82eb 100644 --- a/plugins/tools/plugin.py +++ b/plugins/tools/plugin.py @@ -67,6 +67,11 @@ class ToolsPlugin(BasePlugin): about revoking what a role does or does not hold. """ return [ + # Reaching the tools page at all. The tools themselves run in the + # browser and touch no data, so this is about whether the entry + # appears - which is exactly the question a site answers when it + # decides whether people without an account may use them. + ('tools.view', 'Use the browser tools (codes, conversions)', 'tools'), ('tools.secrets', 'Create secure send links', 'tools'), ] @@ -135,6 +140,9 @@ class ToolsPlugin(BasePlugin): 'route': '/tools', 'position': 47, 'section': 'fleet', + # Either right reaches the page: somebody granted only Secure + # Send still needs the entry that leads to it. + 'permission': ['tools.view', 'tools.secrets'], }, ]