Decide guest grants explicitly instead of by permission name

guest_grantable_permissions() opened any permission whose name ended
'.view' or '.read' to the guest role, on the reasoning that reading is
the safe default. That is true of a permission gating a list of asset
numbers and false of one gating bytes, and a suffix cannot tell them
apart. Twenty-four of eighty-five qualified and none had been decided:

  applications.view  reached the SYSTEM-context PowerShell bodies and
                     the installer binaries pushed to bays
  backups.view       returned the full payload that the separate
                     backups.download permission exists to protect
  assets.view        gated a global search that queries the staff
                     directory, USB history and network inventory with
                     no per-domain check of its own
  audit.view         usernames, addresses, the before/after of every
  settings.view      change, and every setting row - both admin
                     category, opened by naming alone
  users.view         gates nothing at all; list_users is
                     require_role('admin')

Every entry is now declared, by CORE_GUEST_GRANTABLE or by the plugin
that owns the permission, having read what its routes actually return.
Adding one is a code change, which is the point: it puts the decision
in a diff rather than in a suffix.

The two routes serving script bodies and installer packages move to a
new applications.download permission, which is not grantable, so a site
can still open the catalogue metadata to its floor without the bytes
going with it.

The declared set preserves the grants this site had already chosen:
applications.view, computers.view, endpoints.view, reports.view,
tools.secrets, warranty.view.

Two known gaps are recorded on the hooks that expose them rather than
silently carried: the computer serializer publishes every column plus
resolved rdp:// and vnc:// links, and the per-asset endpoint panels are
keyed on a small integer so walking ids reconstructs much of the roster
that endpoints.fleet exists to protect. Neither is widened here.

A shipped test was granting guests audit.view and passing.

Scope: product
(cherry picked from commit 347402896c)

plugins/computers/plugin.py

@@ -2013,3 +2013,20 @@ class ComputersPlugin(BasePlugin):
             ('computers.edit', 'Edit computers', 'computers'),
             ('computers.delete', 'Delete computers', 'computers'),
         ]
+
+    def get_guest_grantable_permissions(self) -> List[str]:
+        """Declared because a site chose it: the floor looks PCs up by number.
+
+        KNOWN GAP, tracked separately. The computer serializer is
+        BaseModel.to_dict(), so it publishes every column - serialnumber, the
+        Azure device and object ids - and the detail route resolves
+        accessmethods into working rdp:// and vnc:// links plus the full
+        Communication row. A guest granted this gets all of it, on the LIST
+        route as well, so it is one request rather than one per asset.
+
+        The fix is a field allowlist on Computer.to_dict() plus suppressing the
+        resolved links unless the caller holds a remote-access permission. Do
+        not widen this hook until that lands; a site enabling guest access
+        today should weigh it.
+        """
+        return ['computers.view']

plugins/endpoints/plugin.py

@@ -145,10 +145,11 @@ class EndpointsPlugin(BasePlugin):
             # including every logged-in username on the floor, because the
             # panels and the list were gated on the same string.
             #
-            # It is deliberately NOT named '.view'. guest_grantable_permissions
-            # opens any '.view' or '.read' permission to the guest role, so this
-            # name is what keeps the fleet roster off the public surface while
-            # per-asset telemetry can still be granted.
+            # The name avoids '.view' for readability, but the NAME no longer
+            # decides anything: guest_grantable_permissions is a declared list
+            # now, and this plugin blesses endpoints.view alone below. Adding
+            # endpoints.fleet there would be what opens the roster, and the
+            # docstring on that hook says why not to.
             ('endpoints.fleet',
              'View the fleet-wide endpoint list and dashboards', 'endpoints'),
             # Issue an allowlisted command to an endpoint agent (for example the
@@ -187,6 +188,21 @@ class EndpointsPlugin(BasePlugin):
              'Submit endpoint agent telemetry (fleet reporting)', 'collector'),
         ]
 
+    def get_guest_grantable_permissions(self) -> List[str]:
+        """Declared because a site chose it: live status on a PC page.
+
+        endpoints.view only. NOT endpoints.fleet - that is the roster, and the
+        whole reason the two were split.
+
+        KNOWN GAP, tracked separately: the per-asset panels this opens are
+        keyed on a small integer asset id and the status panel emits the
+        logged-in username, so walking ids reconstructs most of the roster the
+        split exists to protect. Bounding or rate-limiting the per-asset panels
+        is the fix. Until then a site enabling guest access should know the
+        split is a speed bump here, not a wall.
+        """
+        return ['endpoints.view']
+
     def get_settings_defaults(self) -> List[Dict]:
         """Settings owned by the endpoints agent-key kill switch.
 

plugins/warranty/plugin.py

@@ -174,5 +174,13 @@ class WarrantyPlugin(BasePlugin):
             ('warranty.delete', 'Delete warranties', 'warranty'),
         ]
 
+    def get_guest_grantable_permissions(self) -> List[str]:
+        """Coverage dates and vendor for an asset somebody is standing at.
+
+        Nothing here is a credential and nothing reaches a supplier portal; the
+        provider lookups run server-side with keys the caller never sees.
+        """
+        return ['warranty.view']
+
     def init_app(self, app: Flask, db_instance) -> None:
         logger.info(f"Warranty plugin initialized (v{self.meta.version})")