feat: require explicit dashboard read permission

tests/test_interface_documentation_contract.py

@@ -7,13 +7,28 @@ from govoplan_core.core.modules import (
     documentation_structured_translation_issues,
     localizable_documentation_metadata_keys,
 )
-from govoplan_dashboard.backend.manifest import get_manifest
+from govoplan_dashboard.backend.manifest import READ_SCOPE, get_manifest
 
 
 REPO_ROOT = Path(__file__).resolve().parents[1]
 
 
 class DashboardInterfaceDocumentationContractTests(unittest.TestCase):
+    def test_dashboard_surface_requires_explicit_read_permission(self) -> None:
+        manifest = get_manifest()
+        self.assertEqual({READ_SCOPE}, {item.scope for item in manifest.permissions})
+        self.assertIn(
+            READ_SCOPE,
+            next(
+                item.permissions
+                for item in manifest.role_templates
+                if item.slug == "dashboard_user"
+            ),
+        )
+        self.assertEqual((READ_SCOPE,), manifest.nav_items[0].required_all)
+        self.assertEqual((READ_SCOPE,), manifest.frontend.routes[0].required_all)  # type: ignore[union-attr]
+        self.assertEqual((READ_SCOPE,), manifest.frontend.nav_items[0].required_all)  # type: ignore[union-attr]
+
     def test_surface_hierarchy_remains_declared(self) -> None:
         frontend = get_manifest().frontend
         self.assertIsNotNone(frontend)
@@ -39,6 +54,8 @@ class DashboardInterfaceDocumentationContractTests(unittest.TestCase):
         reference = topics["dashboard.reference.layout-and-widgets"]
 
         self.assertIn("dashboard.state.browser-fallback", home.metadata["help_contexts"])
+        self.assertEqual("workflow", home.metadata["kind"])
+        self.assertEqual((READ_SCOPE,), home.conditions[0].required_scopes)
         self.assertIn("dashboard.field.widget-size", reference.metadata["help_contexts"])
         self.assertIn("save_layout", reference.metadata["consequence_classes"])
         self.assertIn("remove_widget", reference.metadata["consequence_classes"])