Anyone not signed in holds the guest role

Whether somebody with no account may see something was being answered one
feature at a time: a securesend_allow_guests setting, an enable flag per kiosk,
and very nearly a third for guides - each with its own settings page, its own
vocabulary and its own hand-written branch inside a route. Every one of them
answered a permissions question, and this app already administers permissions
per role.

So a caller with no token is not nobody: they hold the seeded `guest` role.
require_permission consults it when there is no identity, which is the entire
mechanism. The role is seeded holding NOTHING, so an upgrade opens no door; a
site opens one by ticking a box in the same grid it uses for every other role,
and closes it the same way. Revocation is read on every request rather than
cached, because taking guest access away is what somebody does the moment they
realise what they opened, and it has to bite immediately.

The redundant @jwt_required() above require_permission is gone from 184 routes.
It was belt-and-braces before; now it is actively wrong, because it refuses a
request with no token before the permission check can have an opinion, so a
grant would appear to do nothing.

What a guest may hold is bounded. Any .view or .read permission is grantable.
A WRITE has to be blessed by whoever owns it, through the new
get_guest_grantable_permissions hook (contract 0.21.0), and Secure Send is the
only case that exists: sending a password to a vendor is the one write this
product means to offer somebody who never signs in. Everything else is refused
by the API and greyed out in the grid rather than warned about - a checkbox
that quietly makes deleting an asset anonymous is not a warning anybody reads
twice. A guest write records no creator: the trail says when and from where,
never who, and that is the reason for the bar.

GE-Enforce and Slides gained read permissions so they can be opened to guests
without handing out the manage right. Their read routes accept either through
require_any_permission, so nothing an existing manager could reach has moved.

The navigation endpoint now returns only what the caller can actually reach.
Without that a signed-out visitor gets a sidebar of the whole app where every
link bounces off the login page, which reads as a broken site rather than as a
closed door. A nav item may name several permissions; holding any one is
enough, which is what GE-Enforce and Slides need now that a viewer and a
manager hold different strings.

Two things this found on the way: current_user is a LocalProxy, so
`current_user is None` is False for a request with nobody behind it - harmless
under a required JWT, an AttributeError the moment verification became
optional. And an image pasted into a guide before its first save was never
attached to it, so it was visible to editors and invisible to every reader;
saving now attaches it, and `flask guides fix-images` repairs what is stored.

The guides guest setting written earlier today is gone. Granting guides.view to
the guest role replaces it, which is the point.

shopdb/core/models/__init__.py

@@ -13,7 +13,8 @@ from .mapsnapshot import MapPositionSnapshot
 from .operatingsystem import OperatingSystem
 from .relationship import AssetRelationship, RelationshipType, RelationshipTypePropagation
 from .communication import Communication, CommunicationType
-from .user import User, Role, Permission, full_permission_catalog
+from .user import (User, Role, Permission, full_permission_catalog,
+                   guest_grantable_permissions)
 from .application import Application, AppVersion
 from .supportteam import SupportTeam, SupportTeamContact
 from .setting import Setting
@@ -57,6 +58,7 @@ __all__ = [
     'Role',
     'Permission',
     'full_permission_catalog',
+    'guest_grantable_permissions',
     # Applications
     'Application',
     'AppVersion',

shopdb/core/models/user.py

@@ -152,6 +152,53 @@ def full_permission_catalog(include_disabled=False):
     return catalog
 
 
+def guest_grantable_permissions():
+    """Which permissions the guest role may be granted.
+
+    Reading is the safe default and covers almost everything a site wants to
+    open up: any `.view` or `.read` permission may be handed to guests.
+
+    A write is different - it lets somebody with no account change this
+    database, and the audit trail can then say when and from where but never
+    who. So a write has to be BLESSED by whoever owns it, through the plugin's
+    get_guest_grantable_permissions(). Secure Send is the case that exists:
+    creating a one-view link for somebody is the whole point of the page, and
+    the page has always been usable by people with no account here.
+
+    Everything else is refused at the door rather than warned about, because a
+    checkbox that quietly makes deleting an asset anonymous is not a warning
+    anybody reads twice.
+    """
+    from flask import current_app, has_app_context
+
+    catalog = full_permission_catalog()
+    grantable = {name for name, _, _ in catalog
+                 if name.endswith('.view') or name.endswith('.read')}
+
+    if not has_app_context():
+        return grantable
+    pm = current_app.extensions.get('plugin_manager')
+    if not pm:
+        return grantable
+
+    known = {name for name, _, _ in catalog}
+    for name, plugin in pm.get_all_plugins().items():
+        if not pm.registry.is_enabled(name):
+            continue
+        try:
+            blessed = plugin.get_guest_grantable_permissions() or []
+        except Exception:
+            if current_app.config.get('DEBUG') or current_app.config.get('TESTING'):
+                raise
+            current_app.logger.exception(
+                'Plugin %s get_guest_grantable_permissions failed', name)
+            continue
+        # A plugin may only bless permissions that exist and that it owns the
+        # naming of; a typo must not silently widen anything.
+        grantable |= {p for p in blessed if p in known}
+    return grantable
+
+
 class Role(BaseModel):
     """User role model."""
     __tablename__ = 'roles'
@@ -171,6 +218,16 @@ class Role(BaseModel):
     def __repr__(self):
         return f"<Role {self.rolename}>"
 
+    # The role a caller with no account is treated as holding.
+    #
+    # Guest access used to be a per-feature boolean setting - one for the
+    # Secure Send page, one for each kiosk, one proposed for guides - which
+    # meant every new question about what a signed-out visitor may see was
+    # answered by writing more code. It is a permissions question, and this app
+    # already administers permissions per role, so a guest is now simply a role
+    # holding no permissions until somebody grants it some.
+    GUEST = 'guest'
+
     def haspermission(self, permission_name: str) -> bool:
         """Check if role has a specific permission."""
         # Admin role has all permissions
@@ -178,6 +235,31 @@ class Role(BaseModel):
             return True
         return any(p.name == permission_name for p in self.permissions)
 
+    @classmethod
+    def guest(cls):
+        """The guest role, or None on a site that has not been seeded yet."""
+        return cls.query.filter_by(rolename=cls.GUEST).first()
+
+    @classmethod
+    def seedguest(cls):
+        """Create the guest role if it is missing. Returns True if created.
+
+        Seeded with NO permissions, which is the same behaviour every site has
+        today: an unauthenticated request is refused. What a guest may do is a
+        decision each site makes in the role grid, not one it inherits from an
+        upgrade.
+        """
+        if cls.query.filter_by(rolename=cls.GUEST).first() is not None:
+            return False
+        db.session.add(cls(
+            rolename=cls.GUEST,
+            description=('Anyone who is not signed in. Holds nothing by '
+                         'default; grant it a permission to open that up to '
+                         'people with no account.'),
+            color='#6C757D',
+        ))
+        return True
+
     def getpermissionnames(self) -> list:
         """Get list of permission names."""
         if self.rolename == 'admin':