Fleet list rebuild and the endpoints permission split

shopdb/utils/authz.py

@@ -86,6 +86,32 @@ def guestholds(permission_name: str) -> bool:
     return any(p.name == permission_name for p in role.permissions)
 
 
+def caller_holds(permission_name: str) -> bool:
+    """Whether THIS caller holds a permission, without refusing the request.
+
+    require_permission answers the same question by returning 401/403. This
+    answers it in the body, for the case where a route serves everyone but
+    should only OFFER something to the callers who can use it.
+
+    The endpoints services panel is the example that prompted it: it emitted
+    Start/Stop buttons for every reader, because the emission never consulted
+    the caller. Clicking them 403s, so nothing was exploitable, but showing a
+    read-only viewer controls over a shop-floor PC is the wrong signal - and it
+    gets worse the moment a site grants that panel to guests.
+
+    Guests are included on purpose: a signed-out visitor holds whatever the
+    guest role was granted, so the answer must come from the same place
+    require_permission gets it.
+    """
+    user = currentuser()
+    if user is None:
+        return guestholds(permission_name)
+    try:
+        return bool(user.haspermission(permission_name))
+    except Exception:
+        return False
+
+
 def require_permission(permission_name: str):
     """Gate a route behind a single permission. Admin role bypasses.