Merge remote-tracking branch 'origin/main' into wilm

# Conflicts:
#	shopdb/__init__.py

shopdb/plugins/base.py

@@ -104,6 +104,23 @@ class BasePlugin(ABC):
         """
         return []
 
+    def get_guest_grantable_permissions(self) -> List[str]:
+        """Permissions this plugin allows a site to grant to the GUEST role.
+
+        A guest is anyone with no account. Any `.view` or `.read` permission is
+        grantable without asking a plugin - reading is the safe default. This
+        hook is for the exception: a WRITE that is genuinely meant to be usable
+        by somebody who never signs in.
+
+        Naming one here does not open it. It makes the checkbox available in
+        the role grid; a site still has to tick it. Return [] (the default) and
+        none of this plugin's writes can ever be made anonymous.
+
+        The bar: could this action be attributed to nobody, forever, and still
+        be defensible in the audit log? If not, leave it out.
+        """
+        return []
+
     def get_settings_defaults(self) -> List[Dict]:
         """Declare the Setting rows this plugin owns.