From 4da6c6aa363432aa2182bf3f8200b7a593e41b8c Mon Sep 17 00:00:00 2001 From: Cam Proudlock Date: Thu, 27 Aug 2026 13:02:35 -0400 Subject: [PATCH] guest role; guide section ticking --- CHANGELOG.md | 40 ++++ frontend/src/views/AppLayout.vue | 23 ++- frontend/src/views/settings/UsersList.vue | 46 ++++- plugins/backups/api/routes.py | 7 - plugins/computers/api/routes.py | 14 -- plugins/geenforce/api/routes.py | 55 ++--- plugins/geenforce/plugin.py | 5 + plugins/guides/api/routes.py | 98 +++++++-- plugins/guides/cli.py | 46 +++++ .../frontend/components/GuideBlocks.vue | 42 +++- plugins/guides/frontend/routes.js | 13 +- plugins/guides/frontend/views/GuideView.vue | 4 + plugins/guides/plugin.py | 4 + plugins/guides/services/blocks.py | 14 +- plugins/knowledgebase/api/routes.py | 3 - plugins/machines/api/routes.py | 7 - plugins/measuringtools/api/routes.py | 6 - plugins/network/api/routes.py | 12 -- plugins/notifications/api/routes.py | 5 - plugins/printedparts/api/routes.py | 13 -- plugins/printedparts/plugin.py | 3 + plugins/printers/api/asset_routes.py | 18 -- plugins/slides/api/routes.py | 9 +- plugins/slides/plugin.py | 6 +- plugins/tools/plugin.py | 13 ++ plugins/usb/api/routes.py | 6 - plugins/warranty/api/routes.py | 9 - shopdb/__init__.py | 2 +- shopdb/api/__init__.py | 3 +- shopdb/cli/__init__.py | 11 +- shopdb/core/api/apitokens.py | 3 - shopdb/core/api/applications.py | 12 -- shopdb/core/api/assets.py | 13 -- shopdb/core/api/auditlogs.py | 5 - shopdb/core/api/dashboard.py | 20 ++ shopdb/core/api/mappositions.py | 5 - shopdb/core/api/reports.py | 1 - shopdb/core/api/settings.py | 4 - shopdb/core/api/users.py | 32 ++- shopdb/core/models/__init__.py | 4 +- shopdb/core/models/user.py | 82 ++++++++ shopdb/plugins/base.py | 17 ++ shopdb/utils/authz.py | 131 +++++++++++- tests/test_core/test_guest_role.py | 190 ++++++++++++++++++ tests/test_plugins/test_guides.py | 17 ++ 45 files changed, 830 insertions(+), 243 deletions(-) create mode 100644 tests/test_core/test_guest_role.py diff --git a/CHANGELOG.md b/CHANGELOG.md index 1a9425fd..8b9670d8 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -12,6 +12,46 @@ ADR-007 and ADR-002. ### Added +- **A guide's sections can be ticked off while you read it.** Only checklist + items were tickable, which answered "what have I done" but not the question a + long procedure actually raises - where was I. Somebody looks away to do the + thing the guide asked for and looks back at a wall of text. Every step and + every heading now carries a checkbox in the reader; ticking one strikes it + through and fades it rather than hiding it, because scanning back up the page + has to still show what was done. Headings count as well as steps: a guide + converted from an HTML article often has fifty headings and no steps at all. + Progress is per browser and per version, as it already was for checklists - + shopfloor PCs share a login, so one technician's ticks must not greet the + next person on that bay. + +- **A guest is a role now, not a switch per feature.** Whether somebody with no + account may see something was answered one feature at a time: a + `securesend_allow_guests` setting, an enable flag per kiosk, and very nearly a + third for guides - each with its own settings page and its own hand-written + branch inside a route. It is a permissions question, and this app already + administers permissions per role, so anyone not signed in now holds the + seeded `guest` role. It starts with nothing, so an upgrade opens no door; a + site opens one by ticking a box in the same role grid it uses for everybody + else, and closes it the same way - taking effect on the next request, not the + next restart. `require_permission` consults the role when there is no token, + which is the whole mechanism. + + What a guest may be granted is bounded: any `.view` or `.read` permission, + plus writes a plugin has explicitly declared safe to perform without an + account (`get_guest_grantable_permissions`, contract 0.21.0). Secure Send + declares its create permission, because sending a password to a vendor is the + one write the product means to offer somebody who never signs in. Everything + else is refused by the API and greyed out in the grid rather than warned + about. A guest write records no creator - the audit trail can say when and + from where, never who - and that is the reason for the bar. + + GE-Enforce and Slides gained read permissions (`geenforce.view`, + `slides.view`) so they can be opened to guests without handing out the manage + right; their read routes accept either, so nothing an existing manager could + reach has moved. The navigation endpoint now returns only what the caller can + actually reach, so a signed-out visitor sees the pages that were opened to + them rather than a sidebar of links that bounce off a login page. + - **USB check-in / check-out audit report.** CMMC removable-media tracking is an audit obligation and there was no report for it - answering "who had this drive, and when" meant paging through the check-in/out list by hand. The diff --git a/frontend/src/views/AppLayout.vue b/frontend/src/views/AppLayout.vue index 2d37253a..8ea01593 100644 --- a/frontend/src/views/AppLayout.vue +++ b/frontend/src/views/AppLayout.vue @@ -11,7 +11,9 @@ -
+ +
slides.manage); hide it from anyone who lacks it so the // link does not dead-end at the router guard. Admins hold every permission. - const visible = items.filter(item => - !item.permission || authStore.hasPermission(item.permission)) + // + // A signed-out visitor sees only what a plugin has declared guest-reachable. + // Without this the sidebar offers a signed-out reader the whole app and every + // link bounces them to the login page, which reads as a broken site rather + // than as a closed door. + // A nav item may name one permission or several; holding ANY of them is + // enough. GE-Enforce and Slides need that: the page is reachable by a + // manager and by a plain viewer, and they hold different strings. + const holds = item => { + if (!item.permission) return true + const names = Array.isArray(item.permission) ? item.permission : [item.permission] + return names.some(name => authStore.hasPermission(name)) + } + // A signed-out visitor gets whatever the server sent, which is already + // filtered to what the guest role can reach - hasPermission knows nothing + // about guests, so asking it here would hide everything. + const visible = authStore.isAuthenticated ? items.filter(holds) : items const known = new Set(NAV_SECTIONS.map(s => s.key).filter(Boolean)) const bucket = item => { diff --git a/frontend/src/views/settings/UsersList.vue b/frontend/src/views/settings/UsersList.vue index 58fd9aaf..242506da 100644 --- a/frontend/src/views/settings/UsersList.vue +++ b/frontend/src/views/settings/UsersList.vue @@ -225,6 +225,17 @@

Select which actions this role can perform

+ +

+ This role is everyone who is not signed in. + Anything ticked here is readable by anybody who can reach this + site, with no account and no name in the audit log. Greyed-out + permissions cannot be given to guests at all. +

@@ -239,10 +250,14 @@
-