Decide guest grants explicitly instead of by permission name

guest_grantable_permissions() opened any permission whose name ended
'.view' or '.read' to the guest role, on the reasoning that reading is
the safe default. That is true of a permission gating a list of asset
numbers and false of one gating bytes, and a suffix cannot tell them
apart. Twenty-four of eighty-five qualified and none had been decided:

  applications.view  reached the SYSTEM-context PowerShell bodies and
                     the installer binaries pushed to bays
  backups.view       returned the full payload that the separate
                     backups.download permission exists to protect
  assets.view        gated a global search that queries the staff
                     directory, USB history and network inventory with
                     no per-domain check of its own
  audit.view         usernames, addresses, the before/after of every
  settings.view      change, and every setting row - both admin
                     category, opened by naming alone
  users.view         gates nothing at all; list_users is
                     require_role('admin')

Every entry is now declared, by CORE_GUEST_GRANTABLE or by the plugin
that owns the permission, having read what its routes actually return.
Adding one is a code change, which is the point: it puts the decision
in a diff rather than in a suffix.

The two routes serving script bodies and installer packages move to a
new applications.download permission, which is not grantable, so a site
can still open the catalogue metadata to its floor without the bytes
going with it.

The declared set preserves the grants this site had already chosen:
applications.view, computers.view, endpoints.view, reports.view,
tools.secrets, warranty.view.

Two known gaps are recorded on the hooks that expose them rather than
silently carried: the computer serializer publishes every column plus
resolved rdp:// and vnc:// links, and the per-asset endpoint panels are
keyed on a small integer so walking ids reconstructs much of the roster
that endpoints.fleet exists to protect. Neither is widened here.

A shipped test was granting guests audit.view and passing.

Scope: product
(cherry picked from commit 347402896c)

tests/test_core/test_guest_role.py

@@ -98,12 +98,35 @@ def test_a_site_with_no_guest_role_behaves_as_it_always_did(client, db):
 # The guardrail
 # ---------------------------------------------------------------------------
 
-def test_a_view_permission_is_grantable(app):
+def test_a_declared_permission_is_grantable(app):
     from shopdb.core.models import guest_grantable_permissions
     with app.app_context():
         grantable = guest_grantable_permissions()
-    assert 'assets.view' in grantable
     assert 'reports.view' in grantable
+    assert 'applications.view' in grantable
+
+
+def test_a_view_permission_is_not_grantable_merely_for_being_a_view(app):
+    """The suffix stopped deciding. These are all '.view' and none is declared.
+
+    assets.view gates a global search that reaches the staff directory;
+    settings.view every setting row; audit.view the before/after of every
+    change; users.view nothing at all. Each was anonymous-grantable purely
+    because of how it was spelled.
+    """
+    from shopdb.core.models import guest_grantable_permissions
+    with app.app_context():
+        grantable = guest_grantable_permissions()
+    for name in ('assets.view', 'settings.view', 'audit.view', 'users.view'):
+        assert name not in grantable, name
+
+
+def test_the_bytes_behind_applications_are_not_grantable(app):
+    """applications.view is grantable only because the bytes moved off it."""
+    from shopdb.core.models import guest_grantable_permissions
+    with app.app_context():
+        grantable = guest_grantable_permissions()
+    assert 'applications.download' not in grantable
 
 
 def test_a_write_permission_is_not_grantable(app):
@@ -127,13 +150,29 @@ def test_the_api_refuses_to_grant_a_guest_a_write(client, db, auth_headers,
     assert guestrole.permissions == []
 
 
-def test_the_api_allows_granting_a_guest_a_view(client, db, auth_headers,
-                                                guestrole):
+def test_the_api_allows_granting_a_guest_a_declared_read(client, db,
+                                                         auth_headers,
+                                                         guestrole):
+    response = client.put('/api/users/roles/{}'.format(guestrole.roleid),
+                          headers=auth_headers,
+                          json={'permissions': ['reports.view']})
+    assert response.status_code == 200
+    assert [p.name for p in guestrole.permissions] == ['reports.view']
+
+
+def test_the_api_refuses_an_undeclared_read(client, db, auth_headers,
+                                            guestrole):
+    """This test used to grant guests audit.view and pass, which is the bug.
+
+    audit.view ends in '.view' and gates usernames, addresses and the
+    before/after of every change in the database.
+    """
     response = client.put('/api/users/roles/{}'.format(guestrole.roleid),
                           headers=auth_headers,
                           json={'permissions': ['audit.view']})
-    assert response.status_code == 200
-    assert [p.name for p in guestrole.permissions] == ['audit.view']
+    assert response.status_code == 400
+    assert 'audit.view' in response.get_json()['data']['error']['message']
+    assert guestrole.permissions == []
 
 
 def test_the_guest_role_cannot_be_deleted(client, auth_headers, guestrole):
@@ -155,8 +194,9 @@ def test_the_role_list_says_what_a_guest_may_hold(client, auth_headers,
     rows = client.get('/api/users/roles', headers=auth_headers).get_json()['data']
     guest = next(r for r in rows if r['rolename'] == 'guest')
     assert guest['isguest'] is True
-    assert 'assets.view' in guest['grantable']
+    assert 'reports.view' in guest['grantable']
     assert 'assets.delete' not in guest['grantable']
+    assert 'assets.view' not in guest['grantable']
 
     other = next((r for r in rows if r['rolename'] != 'guest'), None)
     if other is not None: