guest role; guide section ticking

plugins/slides/api/routes.py

@@ -14,7 +14,7 @@ from flask_jwt_extended import jwt_required
 from werkzeug.utils import secure_filename
 
 from shopdb.api import (db, success_response, error_response, ErrorCodes,
-                        require_permission)
+                        require_permission, require_any_permission)
 from shopdb.api import send_upload
 
 from ..models import TvSlide
@@ -90,8 +90,7 @@ def serve_image(surface, filename):
 # =============================================================================
 
 @slides_bp.route('/<surface>', methods=['GET'])
-@jwt_required()
-@require_permission('slides.manage')
+@require_any_permission('slides.view', 'slides.manage')
 def list_slides(surface):
     if not _valid_surface(surface):
         return error_response(ErrorCodes.VALIDATION_ERROR, 'Unknown surface')
@@ -108,7 +107,6 @@ def list_slides(surface):
 
 
 @slides_bp.route('/<surface>/upload', methods=['POST'])
-@jwt_required()
 @require_permission('slides.manage')
 def upload_slides(surface):
     if not _valid_surface(surface):
@@ -153,7 +151,6 @@ def upload_slides(surface):
 
 
 @slides_bp.route('/<surface>/order', methods=['POST'])
-@jwt_required()
 @require_permission('slides.manage')
 def reorder_slides(surface):
     if not _valid_surface(surface):
@@ -169,7 +166,6 @@ def reorder_slides(surface):
 
 
 @slides_bp.route('/<surface>/delete', methods=['POST'])
-@jwt_required()
 @require_permission('slides.manage')
 def delete_slides(surface):
     if not _valid_surface(surface):
@@ -195,7 +191,6 @@ def delete_slides(surface):
 
 
 @slides_bp.route('/<surface>/<int:slideid>', methods=['PATCH'])
-@jwt_required()
 @require_permission('slides.manage')
 def update_slide(surface, slideid):
     if not _valid_surface(surface):

plugins/slides/plugin.py

@@ -63,6 +63,7 @@ class SlidesPlugin(BasePlugin):
         non-admin role so a curator can manage the lobby TV + screensaver
         without full admin. Admins hold it by default."""
         return [
+            ('slides.view', 'View the slide decks', 'slides'),
             ('slides.manage',
              'Manage lobby display and screensaver slides', 'slides'),
         ]
@@ -76,7 +77,10 @@ class SlidesPlugin(BasePlugin):
                 'icon': 'image',
                 'route': '/settings/slides',
                 'position': 7,
-                'permission': 'slides.manage',
+                # The read permission: a manager holds it implicitly through
+                # the route's require_any_permission, and it is the one a site
+                # can grant to guests.
+                'permission': ['slides.view', 'slides.manage'],
             },
         ]