151d7c4f44
Whether somebody with no account may see something was being answered one feature at a time: a securesend_allow_guests setting, an enable flag per kiosk, and very nearly a third for guides - each with its own settings page, its own vocabulary and its own hand-written branch inside a route. Every one of them answered a permissions question, and this app already administers permissions per role. So a caller with no token is not nobody: they hold the seeded `guest` role. require_permission consults it when there is no identity, which is the entire mechanism. The role is seeded holding NOTHING, so an upgrade opens no door; a site opens one by ticking a box in the same grid it uses for every other role, and closes it the same way. Revocation is read on every request rather than cached, because taking guest access away is what somebody does the moment they realise what they opened, and it has to bite immediately. The redundant @jwt_required() above require_permission is gone from 184 routes. It was belt-and-braces before; now it is actively wrong, because it refuses a request with no token before the permission check can have an opinion, so a grant would appear to do nothing. What a guest may hold is bounded. Any .view or .read permission is grantable. A WRITE has to be blessed by whoever owns it, through the new get_guest_grantable_permissions hook (contract 0.21.0), and Secure Send is the only case that exists: sending a password to a vendor is the one write this product means to offer somebody who never signs in. Everything else is refused by the API and greyed out in the grid rather than warned about - a checkbox that quietly makes deleting an asset anonymous is not a warning anybody reads twice. A guest write records no creator: the trail says when and from where, never who, and that is the reason for the bar. GE-Enforce and Slides gained read permissions so they can be opened to guests without handing out the manage right. Their read routes accept either through require_any_permission, so nothing an existing manager could reach has moved. The navigation endpoint now returns only what the caller can actually reach. Without that a signed-out visitor gets a sidebar of the whole app where every link bounces off the login page, which reads as a broken site rather than as a closed door. A nav item may name several permissions; holding any one is enough, which is what GE-Enforce and Slides need now that a viewer and a manager hold different strings. Two things this found on the way: current_user is a LocalProxy, so `current_user is None` is False for a request with nobody behind it - harmless under a required JWT, an AttributeError the moment verification became optional. And an image pasted into a guide before its first save was never attached to it, so it was visible to editors and invisible to every reader; saving now attaches it, and `flask guides fix-images` repairs what is stored. The guides guest setting written earlier today is gone. Granting guides.view to the guest role replaces it, which is the point.
107 lines
4.1 KiB
Python
107 lines
4.1 KiB
Python
"""Guides plugin.
|
|
|
|
Step-by-step procedures written and read inside ShopDB: images, working
|
|
checklists, dark mode and printable output, with drafts and revision history.
|
|
|
|
Distinct from the knowledgebase plugin, which is a LINK REGISTRY - a
|
|
description, a URL and keywords pointing at a document held somewhere else.
|
|
This holds the document. They share a tag vocabulary on purpose, so one search
|
|
can cover both.
|
|
"""
|
|
|
|
import json
|
|
import logging
|
|
from pathlib import Path
|
|
from typing import List, Dict, Optional, Type
|
|
|
|
from flask import Flask, Blueprint
|
|
|
|
from shopdb.plugins.base import BasePlugin, PluginMeta
|
|
|
|
from .models import Guide, GuideRevision, GuideImage
|
|
from .api import guides_bp
|
|
|
|
logger = logging.getLogger(__name__)
|
|
|
|
|
|
class GuidesPlugin(BasePlugin):
|
|
|
|
def __init__(self):
|
|
self._manifest = self._load_manifest()
|
|
|
|
def _load_manifest(self) -> Dict:
|
|
manifest_path = Path(__file__).parent / 'manifest.json'
|
|
if manifest_path.exists():
|
|
with open(manifest_path, 'r') as fh:
|
|
return json.load(fh)
|
|
return {}
|
|
|
|
@property
|
|
def meta(self) -> PluginMeta:
|
|
return PluginMeta(
|
|
name=self._manifest.get('name', 'guides'),
|
|
version=self._manifest.get('version', '1.0.0'),
|
|
description=self._manifest.get('description', 'Step-by-step guides'),
|
|
author=self._manifest.get('author', 'ShopDB Team'),
|
|
dependencies=self._manifest.get('dependencies', []),
|
|
core_version=self._manifest.get('core_version', '>=0.1.0,<1.0.0'),
|
|
api_prefix=self._manifest.get('api_prefix', '/api/guides'),
|
|
)
|
|
|
|
def get_blueprint(self) -> Optional[Blueprint]:
|
|
return guides_bp
|
|
|
|
def get_models(self) -> List[Type]:
|
|
return [Guide, GuideRevision, GuideImage]
|
|
|
|
def get_permissions(self) -> List:
|
|
"""Five permissions, and the split between the last two is the point.
|
|
|
|
publish is separate from edit so a technician can write up a procedure
|
|
while somebody else decides it is fit for the floor. Without that split,
|
|
anyone who can fix a typo can also put an unreviewed procedure in front
|
|
of an operator.
|
|
|
|
create without edit is a working combination on purpose: an author may
|
|
edit their OWN guide while it is unpublished, and needs guides.edit once
|
|
other people are following it (see _mayedit in the API).
|
|
"""
|
|
return [
|
|
('guides.view', 'View guides', 'guides'),
|
|
('guides.create', 'Create guides and edit your own drafts', 'guides'),
|
|
('guides.edit', 'Edit any guide, including published ones', 'guides'),
|
|
('guides.publish', 'Publish or withdraw a guide', 'guides'),
|
|
('guides.delete', 'Delete guides', 'guides'),
|
|
]
|
|
|
|
def get_navigation_items(self) -> List[Dict]:
|
|
# Position 8, directly under Slides (7), rather than down in the
|
|
# Information section with the reference lists. A guide is something you
|
|
# go and DO something with, like a slide deck you put on a screen - not
|
|
# a catalogue you look things up in.
|
|
#
|
|
# Warranties held 8 as well, and a TIE is broken by plugin load order,
|
|
# so Guides landed underneath it and read as "not under Slides at all".
|
|
# Warranties moved to 9. Two nav items sharing a position is not a
|
|
# preference, it is a coin toss.
|
|
return [
|
|
{
|
|
'name': 'Guides',
|
|
'icon': 'book-open',
|
|
'route': '/guides',
|
|
'position': 8,
|
|
# The nav endpoint hides an item whose permission the caller
|
|
# does not hold, so a signed-out visitor sees Guides only when
|
|
# the guest role has been granted guides.view.
|
|
'permission': 'guides.view',
|
|
},
|
|
]
|
|
|
|
def get_cli_commands(self) -> List:
|
|
"""CLI: import an existing HTML article as a draft guide."""
|
|
from .cli import build_cli
|
|
return build_cli()
|
|
|
|
def init_app(self, app: Flask, db_instance) -> None:
|
|
logger.info('Guides plugin initialized (v%s)', self.meta.version)
|