diff --git a/docs/PROJECT-MAP.md b/docs/PROJECT-MAP.md index 55c9db80..3775fef3 100644 --- a/docs/PROJECT-MAP.md +++ b/docs/PROJECT-MAP.md @@ -90,6 +90,6 @@ Manifest-less directories under `plugins/` are core frontend surface and always ## Size -- test functions defined: **1570** (parametrised cases collect higher) -- documented API paths: **345** (`docs/openapi.json`, regenerate with `scripts/gen_openapi.py`) +- test functions defined: **1575** (parametrised cases collect higher) +- documented API paths: **346** (`docs/openapi.json`, regenerate with `scripts/gen_openapi.py`) diff --git a/docs/api-inventory.json b/docs/api-inventory.json index 235f3992..d649c157 100644 --- a/docs/api-inventory.json +++ b/docs/api-inventory.json @@ -423,6 +423,14 @@ "params": "none", "example": "curl http://localhost:5001/api/dashboard/navigation" }, + { + "method": "GET", + "path": "/api/dashboard/capabilities", + "purpose": "Booleans describing what THIS caller may reach, so the app chrome can avoid drawing controls that would only answer 401; cansearch reports whether the caller holds assets.view, which a signed-out visitor does when the guest role has been granted it", + "auth": "none", + "params": "none", + "example": "curl http://localhost:5001/api/dashboard/capabilities" + }, { "method": "GET", "path": "/api/dashboard/widgets", diff --git a/docs/openapi.json b/docs/openapi.json index 14eec236..3d20663c 100644 --- a/docs/openapi.json +++ b/docs/openapi.json @@ -2447,6 +2447,34 @@ } } }, + "/api/dashboard/capabilities": { + "get": { + "tags": [ + "core-platform" + ], + "summary": "Booleans describing what THIS caller may reach, so the app chrome can avoid drawing controls that would only answer...", + "description": "Booleans describing what THIS caller may reach, so the app chrome can avoid drawing controls that would only answer 401; cansearch reports whether the caller holds assets.view, which a signed-out visitor does when the guest role has been granted it\n\n**Auth:** none\n\n**Params:** none\n\n**Example:**\n```\ncurl http://localhost:5001/api/dashboard/capabilities\n```", + "security": [], + "responses": { + "200": { + "description": "Success. Body is the success_response envelope: {status, data, meta}.", + "content": { + "application/json": { + "$ref": "#/components/schemas/SuccessEnvelope" + } + } + }, + "default": { + "description": "Error. Body is the error envelope; the code and message are nested under data.error.", + "content": { + "application/json": { + "$ref": "#/components/schemas/ErrorEnvelope" + } + } + } + } + } + }, "/api/dashboard/widgets": { "get": { "tags": [ diff --git a/frontend/src/api/index.js b/frontend/src/api/index.js index e3eaa19d..6bc0f1b3 100644 --- a/frontend/src/api/index.js +++ b/frontend/src/api/index.js @@ -536,6 +536,9 @@ export const dashboardApi = { }, navigation() { return api.get('/dashboard/navigation') + }, + capabilities() { + return api.get('/dashboard/capabilities') } } diff --git a/frontend/src/views/AppLayout.vue b/frontend/src/views/AppLayout.vue index cdf8ce56..dfe40089 100644 --- a/frontend/src/views/AppLayout.vue +++ b/frontend/src/views/AppLayout.vue @@ -11,9 +11,12 @@ - -
+ +
route.path.startsWith('/settings') ? '/settings' : route.path ) const searchQuery = ref('') +// Starts false so the box is never drawn before the server has said the +// caller can use it. A flash of a control that then vanishes reads worse than +// one that arrives a moment late. +const cansearch = ref(false) const navItems = ref([]) const activeNotifications = ref([]) const facilityName = ref('ShopDB') @@ -289,6 +296,15 @@ onMounted(async () => { navItems.value = buildNavItems(defaultNav) } + try { + const caps = await dashboardApi.capabilities() + cansearch.value = !!caps.data.data?.cansearch + } catch (err) { + // Leave the box hidden. Guessing from isAuthenticated here would put it + // back in front of members who cannot search, which is the thing this + // replaced. + } + try { const resp = await notificationsApi.active() activeNotifications.value = resp.data.data?.notifications || [] diff --git a/shopdb/core/api/dashboard.py b/shopdb/core/api/dashboard.py index 5d197e22..d6d3e9f7 100644 --- a/shopdb/core/api/dashboard.py +++ b/shopdb/core/api/dashboard.py @@ -252,6 +252,38 @@ def get_navigation(): return success_response(all_items) +@dashboard_bp.route('/capabilities', methods=['GET']) +def get_capabilities(): + """What THIS caller can reach, for chrome that would otherwise only 401. + + The sidebar search box was gated on being signed in, because a box that + can only answer 401 is worse than no box. That stopped being the right + test once the guest role could be granted assets.view: a signed-out + visitor at a machine may now search for the asset number in front of them, + and the box stayed hidden from exactly the person it was re-opened for. + + The client cannot answer this itself. Its hasPermission getter reads the + signed-in user's permission list, and a guest has no user at all, so + asking it about a guest returns false for everyone. The navigation route + above has the same problem and solves it the same way: the server knows + what the guest role holds, so the server decides. + + Public, and deliberately so - it is the pre-login call that decides + whether the box is drawn. It reports only booleans about the caller, never + what the guest role holds in general, so it says nothing to an anonymous + reader that the rendered page does not already. + """ + from flask_jwt_extended import verify_jwt_in_request + from shopdb.utils.authz import caller_holds + + verify_jwt_in_request(optional=True) + return success_response({ + # Global search is gated on assets.view, and each domain behind it now + # gates on its own permission, so holding this reaches assets alone. + 'cansearch': caller_holds('assets.view'), + }) + + @dashboard_bp.route('/widgets', methods=['GET']) @require_permission('assets.view') def get_widgets(): diff --git a/tests/test_core/test_guest_role.py b/tests/test_core/test_guest_role.py index 9381a436..5d21dad9 100644 --- a/tests/test_core/test_guest_role.py +++ b/tests/test_core/test_guest_role.py @@ -255,3 +255,38 @@ def test_a_bad_token_is_still_refused(client, db, guestrole): headers={'Authorization': 'Bearer not.a.token'}) assert response.status_code == 422 + +# --------------------------------------------------------------------------- +# What the chrome is allowed to draw +# --------------------------------------------------------------------------- + +def test_a_guest_is_not_offered_search_before_the_grant(client, guestrole): + """The box is hidden until somebody opens the door, not by default.""" + body = client.get('/api/dashboard/capabilities').get_json()['data'] + assert body['cansearch'] is False + + +def test_granting_a_guest_assets_view_offers_them_search(client, db, guestrole): + """The point of the whole exercise: a signed-out visitor standing at a + machine gets the box, so they can look up the number in front of them.""" + grant(db, guestrole, 'assets.view') + body = client.get('/api/dashboard/capabilities').get_json()['data'] + assert body['cansearch'] is True + + +def test_a_member_without_assets_view_is_not_offered_search(client, db, + member_headers): + """It used to be drawn for anyone signed in, and answered 401 to the ones + who could not use it.""" + body = client.get('/api/dashboard/capabilities', + headers=member_headers).get_json()['data'] + assert body['cansearch'] is False + + +def test_capabilities_does_not_report_what_the_guest_role_holds(client, db, + guestrole): + """It answers about the CALLER only. A signed-out reader learns whether + their own box is drawn, not the shape of the site's guest policy.""" + grant(db, guestrole, 'assets.view') + body = client.get('/api/dashboard/capabilities').get_json()['data'] + assert set(body) == {'cansearch'} diff --git a/tests/test_core/test_public_read_surface.py b/tests/test_core/test_public_read_surface.py index 68db806c..992c0ce1 100644 --- a/tests/test_core/test_public_read_surface.py +++ b/tests/test_core/test_public_read_surface.py @@ -28,6 +28,10 @@ PUBLIC_ENDPOINTS = { 'plugins.list_enabled_plugins', 'dashboard.get_navigation', # filtered per caller; a guest sees only # what the guest role can reach + 'dashboard.get_capabilities', # booleans about the CALLER, used to decide + # whether the search box is drawn at all; + # it must answer a signed-out visitor or + # the guest grant cannot reach the chrome 'dashboard.health_check', # monitoring has no account # Settings: the handler serves an unauthenticated caller only the public