Model the read/write split in the UI: read-only views, self-revoke and inherited-grant guards

2026-08-05 14:47:51 +02:00
parent 0011182f16
commit 3491e6109f
28 changed files with 287 additions and 79 deletions
@@ -6,7 +6,8 @@
  const filters = include("partials/filter-bar", model.filterBar);
  const table = include("partials/data-table", model.table);
  const pager = include("partials/pagination", model.pagination);
-  const actions = '<a class="btn btn-primary" href="' + localeHref("/admin/users/new") + '"><svg class="ico ico-sm" aria-hidden="true"><use href="#i-plus"/></svg>' + t("admin.users.new") + '</a>';
+  // Only offer "New user" to a users:write holder — a users:read one would get the 403 page.
+  const actions = model.canWrite === false ? "" : '<a class="btn btn-primary" href="' + localeHref("/admin/users/new") + '"><svg class="ico ico-sm" aria-hidden="true"><use href="#i-plus"/></svg>' + t("admin.users.new") + '</a>';
 -%>
 <%- include("partials/shell", {
  actions,