read table definition if I can import - web allows for import export to authorized users

web/src/authz.rs

@@ -19,7 +19,8 @@ pub(crate) const ALL_ECB: &str = "ecb:*";
 /// its own grant rather than something `read` implies, and loading one in is
 /// its own grant rather than something `insert` implies — so a superadmin can
 /// hand a role the row access without the bulk transfer, or the other way
-/// round.
+/// round. `import` is the whole authorization for the bulk endpoint: a role
+/// that holds it may load a file without holding `insert`.
 pub(crate) const EXPORT: &str = "export";
 pub(crate) const IMPORT: &str = "import";
 
@@ -146,6 +147,25 @@ mod tests {
         assert!(!outranks("sales", "clerk"));
     }
 
+    /// The transfer links are shown on the grant and nothing else. A role
+    /// invented this morning holds them exactly as superadmin does, and a role
+    /// with every structural area but no transfer grant sees neither link.
+    #[test]
+    fn the_transfer_links_follow_the_grant_not_the_role_name() {
+        let warehouse = AuthorizationSnapshot {
+            role: "warehouse-night-shift".to_string(),
+            ..snapshot(&[("data:acme/stock", IMPORT)])
+        };
+        assert!(can_transfer_anything(&warehouse, IMPORT));
+        assert!(!can_transfer_anything(&warehouse, EXPORT));
+        assert!(permits_table(&warehouse, "acme", "stock", IMPORT));
+        assert!(!permits_table(&warehouse, "acme", "invoice", IMPORT));
+
+        let structural = snapshot(&[(STRUCT_TABLE, MANAGE), (STRUCT_ROLE, MANAGE)]);
+        assert!(!can_transfer_anything(&structural, IMPORT));
+        assert!(!can_transfer_anything(&structural, EXPORT));
+    }
+
     #[test]
     fn data_wildcards_match_the_server_object_shapes() {
         let global = snapshot(&[("data:*", "read")]);