"""Revoke a guest grant that never did anything, before it locks the role.

tools.secrets was declared guest-grantable, so the role grid offered it and
stored it - and the secure-send route never consulted the guest ROLE at all. It
decides on the securesend_allow_guests setting, which fails closed and carries
the rate limit. A site that ticked the box got no change in behaviour, in either
direction.

The plugin no longer declares it grantable. That alone would repeat the deadlock
fixed in 723a4ff: update_role refuses the WHOLE request when a submitted
permission is not grantable, and the role grid resubmits what the role already
holds - so a site whose guest role holds tools.secrets could no longer save the
guest role at all, including to change something else entirely.

So the grant is removed here, from the one role that could hold it. Nothing is
lost: it granted nothing. Guest secret-link creation stays exactly where it was,
under securesend_allow_guests.

Only the GUEST role is touched. A signed-in role holding tools.secrets is
unaffected - that permission works normally for an account.

Revision ID: 7d41_drop_guest_tools_secrets
Revises: 7d40_machine_maintenance_dates
"""
from alembic import op

import sqlalchemy as sa


revision = '7d41_drop_guest_tools_secrets'
down_revision = '7d40_machine_maintenance_dates'
branch_labels = None
depends_on = None


def upgrade():
    bind = op.get_bind()
    inspector = sa.inspect(bind)
    tables = set(inspector.get_table_names())
    if not {'roles', 'permissions', 'rolepermissions'} <= tables:
        return

    bind.execute(sa.text(
        'DELETE FROM rolepermissions WHERE roleid IN '
        '(SELECT roleid FROM roles WHERE rolename = :guest) '
        'AND permissionid IN '
        '(SELECT permissionid FROM permissions WHERE name = :permission)'),
        {'guest': 'guest', 'permission': 'tools.secrets'})


def downgrade():
    """Deliberately a no-op.

    Re-granting a permission that nothing reads would restore the confusion
    rather than any capability.
    """