Let a guest actually use search: declare the shipped guest grants, and draw the box for whoever can search

shopdb/core/api/dashboard.py

@@ -252,6 +252,38 @@ def get_navigation():
     return success_response(all_items)
 
 
+@dashboard_bp.route('/capabilities', methods=['GET'])
+def get_capabilities():
+    """What THIS caller can reach, for chrome that would otherwise only 401.
+
+    The sidebar search box was gated on being signed in, because a box that
+    can only answer 401 is worse than no box. That stopped being the right
+    test once the guest role could be granted assets.view: a signed-out
+    visitor at a machine may now search for the asset number in front of them,
+    and the box stayed hidden from exactly the person it was re-opened for.
+
+    The client cannot answer this itself. Its hasPermission getter reads the
+    signed-in user's permission list, and a guest has no user at all, so
+    asking it about a guest returns false for everyone. The navigation route
+    above has the same problem and solves it the same way: the server knows
+    what the guest role holds, so the server decides.
+
+    Public, and deliberately so - it is the pre-login call that decides
+    whether the box is drawn. It reports only booleans about the caller, never
+    what the guest role holds in general, so it says nothing to an anonymous
+    reader that the rendered page does not already.
+    """
+    from flask_jwt_extended import verify_jwt_in_request
+    from shopdb.utils.authz import caller_holds
+
+    verify_jwt_in_request(optional=True)
+    return success_response({
+        # Global search is gated on assets.view, and each domain behind it now
+        # gates on its own permission, so holding this reaches assets alone.
+        'cansearch': caller_holds('assets.view'),
+    })
+
+
 @dashboard_bp.route('/widgets', methods=['GET'])
 @require_permission('assets.view')
 def get_widgets():