guest role; guide section ticking

shopdb/core/models/user.py

@@ -152,6 +152,53 @@ def full_permission_catalog(include_disabled=False):
     return catalog
 
 
+def guest_grantable_permissions():
+    """Which permissions the guest role may be granted.
+
+    Reading is the safe default and covers almost everything a site wants to
+    open up: any `.view` or `.read` permission may be handed to guests.
+
+    A write is different - it lets somebody with no account change this
+    database, and the audit trail can then say when and from where but never
+    who. So a write has to be BLESSED by whoever owns it, through the plugin's
+    get_guest_grantable_permissions(). Secure Send is the case that exists:
+    creating a one-view link for somebody is the whole point of the page, and
+    the page has always been usable by people with no account here.
+
+    Everything else is refused at the door rather than warned about, because a
+    checkbox that quietly makes deleting an asset anonymous is not a warning
+    anybody reads twice.
+    """
+    from flask import current_app, has_app_context
+
+    catalog = full_permission_catalog()
+    grantable = {name for name, _, _ in catalog
+                 if name.endswith('.view') or name.endswith('.read')}
+
+    if not has_app_context():
+        return grantable
+    pm = current_app.extensions.get('plugin_manager')
+    if not pm:
+        return grantable
+
+    known = {name for name, _, _ in catalog}
+    for name, plugin in pm.get_all_plugins().items():
+        if not pm.registry.is_enabled(name):
+            continue
+        try:
+            blessed = plugin.get_guest_grantable_permissions() or []
+        except Exception:
+            if current_app.config.get('DEBUG') or current_app.config.get('TESTING'):
+                raise
+            current_app.logger.exception(
+                'Plugin %s get_guest_grantable_permissions failed', name)
+            continue
+        # A plugin may only bless permissions that exist and that it owns the
+        # naming of; a typo must not silently widen anything.
+        grantable |= {p for p in blessed if p in known}
+    return grantable
+
+
 class Role(BaseModel):
     """User role model."""
     __tablename__ = 'roles'
@@ -171,6 +218,16 @@ class Role(BaseModel):
     def __repr__(self):
         return f"<Role {self.rolename}>"
 
+    # The role a caller with no account is treated as holding.
+    #
+    # Guest access used to be a per-feature boolean setting - one for the
+    # Secure Send page, one for each kiosk, one proposed for guides - which
+    # meant every new question about what a signed-out visitor may see was
+    # answered by writing more code. It is a permissions question, and this app
+    # already administers permissions per role, so a guest is now simply a role
+    # holding no permissions until somebody grants it some.
+    GUEST = 'guest'
+
     def haspermission(self, permission_name: str) -> bool:
         """Check if role has a specific permission."""
         # Admin role has all permissions
@@ -178,6 +235,31 @@ class Role(BaseModel):
             return True
         return any(p.name == permission_name for p in self.permissions)
 
+    @classmethod
+    def guest(cls):
+        """The guest role, or None on a site that has not been seeded yet."""
+        return cls.query.filter_by(rolename=cls.GUEST).first()
+
+    @classmethod
+    def seedguest(cls):
+        """Create the guest role if it is missing. Returns True if created.
+
+        Seeded with NO permissions, which is the same behaviour every site has
+        today: an unauthenticated request is refused. What a guest may do is a
+        decision each site makes in the role grid, not one it inherits from an
+        upgrade.
+        """
+        if cls.query.filter_by(rolename=cls.GUEST).first() is not None:
+            return False
+        db.session.add(cls(
+            rolename=cls.GUEST,
+            description=('Anyone who is not signed in. Holds nothing by '
+                         'default; grant it a permission to open that up to '
+                         'people with no account.'),
+            color='#6C757D',
+        ))
+        return True
+
     def getpermissionnames(self) -> list:
         """Get list of permission names."""
         if self.rolename == 'admin':