readonly role

backend/tests/capability_sets_flow.rs

@@ -37,6 +37,7 @@ async fn capability_set_crud_flow() -> Result<()> {
         .map(|set| set.id)
         .expect("owner set present");
     assert!(sets.iter().any(|set| set.slug == "user"));
+    assert!(sets.iter().any(|set| set.slug == "readonly"));
     assert!(sets.iter().any(|set| set.slug == "webdav"));
 
     // Create a new capability set.

backend/tests/common/mod.rs

@@ -17,7 +17,8 @@ use diesel_migrations::{embed_migrations, EmbeddedMigrations, MigrationHarness};
 use http_body_util::BodyExt;
 use once_cell::sync::Lazy;
 use papercrate::auth::capability_sets::{
-    ensure_capability_set, owner_capabilities, user_capabilities, webdav_capabilities,
+    ensure_capability_set, owner_capabilities, readonly_capabilities, user_capabilities,
+    webdav_capabilities,
 };
 use papercrate::auth::jwt::{AccessTokenContext, JwtService, PrincipalKind};
 use papercrate::config::AppConfig;
@@ -360,6 +361,8 @@ impl TestApp {
             .map_err(|err| anyhow!("ensure owner capability set: {err:?}"))?;
         ensure_capability_set(&mut conn, tenant_id, user_capabilities())
             .map_err(|err| anyhow!("ensure user capability set: {err:?}"))?;
+        ensure_capability_set(&mut conn, tenant_id, readonly_capabilities())
+            .map_err(|err| anyhow!("ensure readonly capability set: {err:?}"))?;
         ensure_capability_set(&mut conn, tenant_id, webdav_capabilities())
             .map_err(|err| anyhow!("ensure webdav capability set: {err:?}"))?;