Secure send: hand somebody a password without leaving it in a chat window

tests/test_core/test_authz.py

@@ -50,7 +50,19 @@ EXEMPT_ENDPOINTS = {'knowledgebase.track_click', 'users.update_user',
                     # badge-attributed server-side. Decision record in
                     # docs/proposals/printedparts-plugin.md; justification in
                     # the plugin README.
-                    'printedparts.kiosk_take'}
+                    'printedparts.kiosk_take',
+                    # Redeeming a shared secret. The recipient usually has no
+                    # account here, so the unguessable 128-bit token IS the
+                    # authorisation - gating this on a role would make the
+                    # feature useless for the only case it exists for, handing
+                    # somebody a credential while you are on a call with them.
+                    #
+                    # A mutation because reading SPENDS the secret, and a POST
+                    # rather than a GET because chat and mail clients prefetch
+                    # GET urls and a preview must not consume a one-view link.
+                    # CREATING one is permission-gated and IS swept.
+                    # Justification in plugins/securesend/README.md.
+                    'securesend.redeem_secret'}
 
 
 @pytest.fixture(autouse=True)