I am not quite done here, I need to finish some of the packaging metadata, and I am going to maybe take a pass at permissions prior to release. Opening the pull request so you can easily track the progress.
Note that Sandstorm app metadata is supposed to be less than 1 MB total, so I optimized your screenshots. I dare you to tell the difference with the naked eye.
Forgot to submit this note earlier, it was lost in another tab, but it's still worthwhile to note:
Okay, permissions now works, in that if you try to upload, and you don't hold the upload capability, you get a 401. That's great and all, though ideally we should also probably hide the upload button if you don't have permission to use it.
Okay, so I am going to refactor this a little bit more than you describe here as well: I will also replace RequireSandstormUploadPermission(handler, isSandstorm) with RequireSandstormPermission(handler, permission). Instead of passing the environment variable through, I'll pass the permission we are looking for (in this case, "upload") to the func. That way we should be able to reuse this function for #27 in the future, by passing "admin" to the func instead.