Fleet list rebuild and the endpoints permission split

plugins/endpoints/plugin.py

@@ -103,6 +103,22 @@ class EndpointsPlugin(BasePlugin):
         """
         return [
             ('endpoints.view', 'View endpoint telemetry', 'endpoints'),
+            # The FLEET-WIDE list and dashboards, separate from endpoints.view,
+            # which covers reading ONE endpoint that the caller already reached
+            # through its PC page.
+            #
+            # They were one permission, and that made a reasonable policy
+            # impossible to express: a site that wants signed-out visitors to
+            # see live status on a PC page had to hand them the whole fleet,
+            # including every logged-in username on the floor, because the
+            # panels and the list were gated on the same string.
+            #
+            # It is deliberately NOT named '.view'. guest_grantable_permissions
+            # opens any '.view' or '.read' permission to the guest role, so this
+            # name is what keeps the fleet roster off the public surface while
+            # per-asset telemetry can still be granted.
+            ('endpoints.fleet',
+             'View the fleet-wide endpoint list and dashboards', 'endpoints'),
             # Issue an allowlisted command to an endpoint agent (for example the
             # MTConnect toggle). Separate from endpoints.view because acting on a
             # shop-floor PC is a heavier grant than reading its telemetry.
@@ -189,7 +205,7 @@ class EndpointsPlugin(BasePlugin):
                 'icon': 'activity',
                 'route': '/endpoints',
                 'position': 16,
-                'permission': 'endpoints.view',
+                'permission': 'endpoints.fleet',
                 'section': 'assets',
             },
         ]
@@ -340,7 +356,7 @@ class EndpointsPlugin(BasePlugin):
                 'endpoint': '/api/endpoints/dashboard/quiet',
                 'render': 'exceptions',
                 'severity': 'warning',
-                'permission': 'endpoints.view',
+                'permission': 'endpoints.fleet',
                 'empty': 'hide',
                 'position': 22,
                 'map': {
@@ -358,7 +374,7 @@ class EndpointsPlugin(BasePlugin):
                 'endpoint': '/api/endpoints/dashboard/stability',
                 'render': 'exceptions',
                 'severity': 'critical',
-                'permission': 'endpoints.view',
+                'permission': 'endpoints.fleet',
                 'empty': 'hide',
                 'position': 16,
                 'map': {