readonly role

backend/src/auth/capability_sets.rs

@@ -53,6 +53,14 @@ const USER_CAPABILITIES: [ApiCapability; 16] = [
     ApiCapability::WebdavRead,
 ];
 
+const READONLY_CAPABILITIES: [ApiCapability; 5] = [
+    ApiCapability::CorrespondentsRead,
+    ApiCapability::DocumentsRead,
+    ApiCapability::FoldersRead,
+    ApiCapability::TagsRead,
+    ApiCapability::WebdavRead,
+];
+
 const WEBDAV_CAPABILITIES: [ApiCapability; 1] = [ApiCapability::WebdavRead];
 
 pub fn owner_capabilities() -> &'static [ApiCapability] {
@@ -63,12 +71,16 @@ pub fn user_capabilities() -> &'static [ApiCapability] {
     &USER_CAPABILITIES
 }
 
+pub fn readonly_capabilities() -> &'static [ApiCapability] {
+    &READONLY_CAPABILITIES
+}
+
 pub fn webdav_capabilities() -> &'static [ApiCapability] {
     &WEBDAV_CAPABILITIES
 }
 
 pub fn is_system_slug(slug: &str) -> bool {
-    matches!(slug, "owner" | "user" | "webdav")
+    matches!(slug, "owner" | "user" | "readonly" | "webdav")
 }
 
 pub fn create_capability_set<C>(
@@ -175,7 +187,7 @@ where
             tenant_id,
             slug: slug.clone(),
             cap_version: 1,
-            is_system: slug == "owner" || slug == "user" || slug == "webdav",
+            is_system: matches!(slug.as_str(), "owner" | "user" | "readonly" | "webdav"),
         };
 
         diesel::insert_into(capability_sets::table)
@@ -243,6 +255,10 @@ pub fn compute_slug(capabilities: &[ApiCapability]) -> String {
         return "user".to_string();
     }
 
+    if capabilities == readonly_capabilities() {
+        return "readonly".to_string();
+    }
+
     if capabilities == webdav_capabilities() {
         return "webdav".to_string();
     }