docs(rest): the template's changeset and permission docs name the import door's gates (#20896)

Claude-Session: https://claude.ai/code/session_01Sfe5YjBLwB9J3y8fvm2xq1
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

.changeset/18386-export-import-template.md

@@ -30,8 +30,9 @@ Without a `template` parameter the export is exactly as before, byte for byte.
 - **Language.** The sheets are in Chinese for a `zh` request locale
   (`?locale=` or `Accept-Language`) and in English otherwise.
 
-The same two permission checks as the export apply: an object that does not
-expose export answers `405`, and a caller without the export permission answers
-`403`. `template` with a value other than `true` or `false`, a `format` other
+The import's permission checks apply, not the export's: an object that exposes
+neither create nor update answers `405`, and a caller without the create
+permission on the object answers `403`. The export permission (`allowExport`) is
+not needed. `template` with a value other than `true` or `false`, a `format` other
 than `xlsx`, or any of `limit`, `page`, `filter`, `search`, `searchFields`,
 `orderby` or `header` beside `template=true`, answers `400 VALIDATION_ERROR`.

.changeset/20896-template-import-door.md

@@ -0,0 +1,23 @@
+---
+'@objectstack/rest': patch
+---
+
+fix(rest): the import template (`GET /api/v1/data/:object/export?template=true`) is gated by the import door's permissions, not the export's
+
+Clause-②: no
+
+The template carries no records — only the columns the caller may write, one
+example row and an instructions sheet — so it answers to whoever may import, and
+the export permission (`allowExport`) neither admits nor refuses it:
+
+- A caller with the create permission on the object gets the template, with or
+  without `allowExport`.
+- A caller without the create permission gets `403 PERMISSION_DENIED`, with or
+  without `allowExport`.
+- An object whose `enable.apiMethods` exposes neither `create` nor `update`
+  answers `405 OBJECT_API_METHOD_NOT_ALLOWED`, as `POST /api/v1/data/:object/import`
+  does. An object that exposes `create` without `list` serves the template.
+- Without `template=true` the export is unchanged: the same two export checks
+  and the same bytes.
+
+To let a role download the template, grant it create on the object.

content/docs/permissions/permission-sets.mdx

@@ -95,7 +95,9 @@ opt-in. Grant it through an ordinary position-distributed set instead.
 Enforcement is server-side and covers both egress doors:
 
 - `GET /api/v1/data/:object/export` answers `403 EXPORT_NOT_PERMITTED` before it
-  reads the first row.
+  reads the first row. Its import template (`?template=true`) is not a copy of
+  data — it carries no records — so it is gated by the import instead: the create
+  permission on the object, never `allowExport`.
 - A **report** rendered as `csv` or `json` is the same bulk copy and is gated the
   same way, whether run interactively or delivered by a schedule. `html_table`
   is a rendered view and stays a read.