Remediate the 2026-09-03 feature-test findings

migrations/versions/7d41_drop_guest_tools_secrets.py

@@ -0,0 +1,56 @@
+"""Revoke a guest grant that never did anything, before it locks the role.
+
+tools.secrets was declared guest-grantable, so the role grid offered it and
+stored it - and the secure-send route never consulted the guest ROLE at all. It
+decides on the securesend_allow_guests setting, which fails closed and carries
+the rate limit. A site that ticked the box got no change in behaviour, in either
+direction.
+
+The plugin no longer declares it grantable. That alone would repeat the deadlock
+fixed in 723a4ff: update_role refuses the WHOLE request when a submitted
+permission is not grantable, and the role grid resubmits what the role already
+holds - so a site whose guest role holds tools.secrets could no longer save the
+guest role at all, including to change something else entirely.
+
+So the grant is removed here, from the one role that could hold it. Nothing is
+lost: it granted nothing. Guest secret-link creation stays exactly where it was,
+under securesend_allow_guests.
+
+Only the GUEST role is touched. A signed-in role holding tools.secrets is
+unaffected - that permission works normally for an account.
+
+Revision ID: 7d41_drop_guest_tools_secrets
+Revises: 7d40_machine_maintenance_dates
+"""
+from alembic import op
+
+import sqlalchemy as sa
+
+
+revision = '7d41_drop_guest_tools_secrets'
+down_revision = '7d40_machine_maintenance_dates'
+branch_labels = None
+depends_on = None
+
+
+def upgrade():
+    bind = op.get_bind()
+    inspector = sa.inspect(bind)
+    tables = set(inspector.get_table_names())
+    if not {'roles', 'permissions', 'rolepermissions'} <= tables:
+        return
+
+    bind.execute(sa.text(
+        'DELETE FROM rolepermissions WHERE roleid IN '
+        '(SELECT roleid FROM roles WHERE rolename = :guest) '
+        'AND permissionid IN '
+        '(SELECT permissionid FROM permissions WHERE name = :permission)'),
+        {'guest': 'guest', 'permission': 'tools.secrets'})
+
+
+def downgrade():
+    """Deliberately a no-op.
+
+    Re-granting a permission that nothing reads would restore the confusion
+    rather than any capability.
+    """