read table definition if I can import - web allows for import export to authorized users

web/src/pages/import_export/common/loader.rs

@@ -29,16 +29,18 @@ pub(crate) struct Profile {
 /// The tables one transfer page may offer.
 ///
 /// `transfer_action` is the page's own grant — `export` or `import`.
-/// `row_action` is what the transfer does underneath, `read` or `insert`, and
-/// it is checked as well: the backend authorizes the row calls the transfer
-/// makes, so a table offered on the strength of the transfer grant alone would
-/// be refused halfway through the download. A table appears here only when the
-/// role holds both.
+///
+/// `row_action` is a second grant to require, for a page whose work the backend
+/// authorizes as ordinary row calls: an export downloads by reading rows, so it
+/// passes `read` and a table offered on the strength of `export` alone would be
+/// refused halfway through the download. An import passes `None` — the bulk
+/// endpoint authorizes `import` itself and never asks for `insert`, so
+/// requiring one here would hide tables the server would happily accept.
 pub(crate) async fn load_catalog(
     state: AppState,
     headers: &HeaderMap,
     transfer_action: &str,
-    row_action: &str,
+    row_action: Option<&str>,
 ) -> Result<Catalog, LoadError> {
     let request = authenticated_request(headers, GetAuthorizationRequest {})
         .map_err(|_| LoadError::Unauthenticated)?;
@@ -58,7 +60,9 @@ pub(crate) async fn load_catalog(
     }
     let permits = |profile: &str, table: &str| {
         crate::authz::permits_table(&authorization, profile, table, transfer_action)
-            && crate::authz::permits_table(&authorization, profile, table, row_action)
+            && row_action.is_none_or(|action| {
+                crate::authz::permits_table(&authorization, profile, table, action)
+            })
     };
     let mut definitions = state.definitions;
     let tree = definitions

web/src/pages/import_export/export/loader.rs

@@ -8,7 +8,7 @@ pub(crate) async fn load_page(
     state: AppState,
     headers: &HeaderMap,
 ) -> Result<ExportPageState, LoadError> {
-    let catalog = load_catalog(state, headers, crate::authz::EXPORT, "read").await?;
+    let catalog = load_catalog(state, headers, crate::authz::EXPORT, Some("read")).await?;
     Ok(ExportPageState {
         nav: crate::ui::Nav::from_authorization(headers, "", &catalog.authorization),
         catalog,

web/src/pages/import_export/import/loader.rs

@@ -13,7 +13,7 @@ pub(crate) async fn load_page(
     form: ImportForm,
     step: Step,
 ) -> Result<ImportPageState, LoadError> {
-    let catalog = load_catalog(state, headers, crate::authz::IMPORT, "insert").await?;
+    let catalog = load_catalog(state, headers, crate::authz::IMPORT, None).await?;
     Ok(ImportPageState {
         nav: crate::ui::Nav::from_authorization(headers, "", &catalog.authorization),
         catalog,