[czpython]

Teams now decide who can use an app. With no teams, every account uses every app as before.

The check

Team.allows(session, account, app) is the one place that reads a team's app list:

1. An admin can use every app.
2. Every account can use an app that no team lists. A built-in app is always open.
3. A member can use an app when a team that lists it has that member.
4. Otherwise Druks refuses.

A bot account keeps its own rules. A person with no account counts as a member of no team. No key skips the check.

Where it runs

• In front of every route of an app, set in mount(). That covers the app's pages, operations, uploads, and its MCP and chat tools.
• The MCP tool list hides the tools of an app that the token's account cannot use.
• Workflow.start, for the run's account. A refused start raises PermissionDenied and starts nothing. A scheduled run makes the same check for the unattended account.
• The routes that act on a run: resume, cancel, retry, get_gate and answer_gate. The check comes before any other answer about the run.
• Run now, for the app that declares the schedule.
• Pairing a phone with a private Bot's number, by the number's app.

Each route gate is a dependency in druks/teams/dependencies.py. A refusal answers 403 with the code APP_PERMISSION_DENIED and names the app.

A run that started is never refused later because a team changed. Inside a workflow body the answer is recorded in a step, so a replay reuses it.

Platform

druks.exceptions.PermissionDenied: one error for a thing an account may not do, beside ValidationError. The server answers 403 with its message.

Software Factory

• A ticket move by a person who cannot use Software Factory opens no build, and the work item records why (build.rejected).
• When a team lists Software Factory, a ticket move by a person with no Druks account also opens no build, and Druks does not use the assignee or the default account instead. While no team lists it, that move opens a build as before.

Not in this change

The reads that span apps (the dashboard, the activity feed, the app roster), Slack buttons and answer links. A member still sees a refused app in the sidebar.