Let a wiki's owner decide whether API, widget and public-link runs edit it

A run from an agent's API key or widget acts as the agent's owner, so it
could rewrite any wiki the owner can edit. A new per-wiki setting,
wiki_outside_edits (off by default), decides whether such runs, and runs
from the agent's public link, get the wiki's edit actions. While it is off
they are offered only wiki_view, and the tool refuses writes itself after
reading the live setting. The owner changes it through the owner-only
/api/sources/<id>/wiki/settings route; tokens can read it but not change it.

tests/api/answer/services/test_stream_processor_access.py

@@ -116,3 +116,33 @@ class TestWikiConfigAccess:
         assert cfg["source_owner_id"] == OWNER and cfg["user"] == "ed"
         assert self._cfg(use_conn, "vi", sid) is None
         assert self._cfg(use_conn, "eve", sid) is None
+
+
+class TestWikiOutsideEdits:
+    """API, widget and public-link runs edit a wiki only when its owner allows."""
+
+    def _tools(self, conn, caller, sid, agent_config):
+        from docsgpt.agents.tools.wiki import WIKI_TOOL_ID, add_wiki_tool
+        from docsgpt.api.answer.services.stream_processor import StreamProcessor
+
+        proc = StreamProcessor.__new__(StreamProcessor)
+        proc.all_sources = [{"id": sid}]
+        proc.decoded_token = {"sub": caller}
+        proc.agent_config = agent_config
+        cfg = proc._build_wiki_config()
+        tools = {}
+        add_wiki_tool(tools, cfg)
+        return {a["name"] for a in tools[WIKI_TOOL_ID]["actions"]}
+
+    @pytest.mark.parametrize("flag", ["external_api_caller", "public_link_caller"])
+    def test_outside_caller_reads_until_the_owner_allows_edits(self, use_conn, flag):
+        sid = str(SourcesRepository(use_conn).create("W", user_id=OWNER, config={"kind": "wiki"})["id"])
+        assert self._tools(use_conn, OWNER, sid, {flag: True}) == {"wiki_view"}
+        SourcesRepository(use_conn).set_wiki_outside_edits(sid, OWNER, True)
+        assert "wiki_create" in self._tools(use_conn, OWNER, sid, {flag: True})
+
+    def test_owner_and_team_editor_keep_every_action(self, use_conn):
+        sid = str(SourcesRepository(use_conn).create("W", user_id=OWNER, config={"kind": "wiki"})["id"])
+        _share(use_conn, "source", sid, "ed", "editor")
+        assert "wiki_create" in self._tools(use_conn, OWNER, sid, {})
+        assert "wiki_create" in self._tools(use_conn, "ed", sid, {})