Model the read/write split in the UI: read-only views, self-revoke and inherited-grant guards

2026-08-05 14:47:51 +02:00
parent 0011182f16
commit 3491e6109f
28 changed files with 287 additions and 79 deletions
@@ -23,13 +23,15 @@
 <% }) -%>
    <div class="form-actions">
      <a class="btn" href="<%= localeHref(form.cancelHref) %>"><%= t("common.cancel") %></a>
+<% if (locals.canWrite !== false) { -%>
      <button class="btn btn-primary" type="submit"><%= form.submitLabel %></button>
+<% } -%>
    </div>
  </form>
 <% if (edit && locals.permissions) { -%>
 <%- include("partials/permission-picker", { csrfToken: form.csrfToken, permissions: locals.permissions }) %>
 <% } -%>
-<% if (edit) { -%>
+<% if (edit && locals.canWrite !== false) { -%>
  <section class="form-card admin-actions" aria-label="<%= t("admin.users.actions") %>">
    <form method="post" action="<%= localeHref(edit.recoveryAction) %>"><input type="hidden" name="_csrf" value="<%= form.csrfToken %>"><button class="btn" type="submit"><svg class="ico ico-sm" aria-hidden="true"><use href="#i-mail"/></svg><%= t("admin.users.recovery.generate") %></button></form>
    <form method="post" action="<%= localeHref(edit.stateAction) %>"><input type="hidden" name="_csrf" value="<%= form.csrfToken %>"><button class="btn" type="submit"><%= edit.nextLabel %></button></form>