readonly role

backend/tests/common/mod.rs

@@ -17,7 +17,8 @@ use diesel_migrations::{embed_migrations, EmbeddedMigrations, MigrationHarness};
 use http_body_util::BodyExt;
 use once_cell::sync::Lazy;
 use papercrate::auth::capability_sets::{
-    ensure_capability_set, owner_capabilities, user_capabilities, webdav_capabilities,
+    ensure_capability_set, owner_capabilities, readonly_capabilities, user_capabilities,
+    webdav_capabilities,
 };
 use papercrate::auth::jwt::{AccessTokenContext, JwtService, PrincipalKind};
 use papercrate::config::AppConfig;
@@ -360,6 +361,8 @@ impl TestApp {
             .map_err(|err| anyhow!("ensure owner capability set: {err:?}"))?;
         ensure_capability_set(&mut conn, tenant_id, user_capabilities())
             .map_err(|err| anyhow!("ensure user capability set: {err:?}"))?;
+        ensure_capability_set(&mut conn, tenant_id, readonly_capabilities())
+            .map_err(|err| anyhow!("ensure readonly capability set: {err:?}"))?;
         ensure_capability_set(&mut conn, tenant_id, webdav_capabilities())
             .map_err(|err| anyhow!("ensure webdav capability set: {err:?}"))?;