@synopackageland/templates 0.17.9 → 0.17.10

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synopackageland/templates",
-  "version": "0.17.9",
+  "version": "0.17.10",
   "description": "Project templates for synopkgland init: native-go, native-python, native-node and native-rust (plain or Vue, with jobs, delegate and root-ops overlays), binary and compose.",
   "license": "MIT",
   "repository": {

package/templates/native-go/backend/internal/app/shared_folder.go

@@ -22,9 +22,9 @@ func (cfg Config) sharedFolders() sharedfolder.Config {
 
 // sharedFolderStatus answers the settings page: each folder, what the package
 // account has and what the App declared it needs, and whether an
-// administrator still has to grant. Administrators only, as the default
-// permissions say; list the method in internal/api/permissions.json to let
-// every DSM user read it.
+// administrator still has to grant. The SDK's authenticated policy lets any
+// signed-in DSM user read this status; granting package access stays an
+// administrator operation.
 func (cfg Config) sharedFolderStatus(ctx context.Context, _ api.Caller, _ json.RawMessage) (any, error) {
 	status, err := cfg.sharedFolders().Status()
 	if err != nil {

package/templates/native-go/backend/internal/app/shared_folder_test.go

@@ -67,10 +67,14 @@ func TestSharedFolderStatusReportsGrantedAndPending(t *testing.T) {
 	}
 }
 
-func TestSharedFolderStatusIsAdministratorOnlyByDefault(t *testing.T) {
+func TestSharedFolderStatusUsesSDKAuthenticatedPolicy(t *testing.T) {
 	cfg := sharedFixture(t, 0o755)
-	if code, _ := call(t, cfg, bob, "sharedfolder.status", `{}`); code == "" {
-		t.Fatal("a non-administrator read the status")
+	// The SDK owns this read-only method's policy, including in jobs overlays.
+	if code, _ := call(t, cfg, bob, "sharedfolder.status", `{}`); code != "" {
+		t.Fatalf("a signed-in user could not read the status: %q", code)
+	}
+	if code, _ := call(t, cfg, nobody, "sharedfolder.status", `{}`); code != "session_required" {
+		t.Fatalf("a signed-out caller got %q, want session_required", code)
 	}
 }