Model the read/write split in the UI: read-only views, self-revoke and inherited-grant guards

2026-08-05 14:47:51 +02:00
parent 29d654c012
commit 765f349007
28 changed files with 287 additions and 79 deletions
@@ -38,10 +38,10 @@ export function actionForMethod(method: string): AdminAction {
  return verb === "GET" || verb === "HEAD" ? "read" : "write";
 }

-// The plugin's nav fragment: an ungated "Admin" header + its four screens, each gated on its own
+// The plugin's nav fragment: an ungated "Admin" header + its three screens, each gated on its own
 // read permission. The header carries no `permission` because a user may hold one screen's and not
 // another's; composeNav drops a header left with no visible children, so a user holding none of the
-// four never sees the section. The host current-marks the active item — no `current`/`open` here.
+// three never sees the section. The host current-marks the active item — no `current`/`open` here.
 export const ADMIN_NAV: NavNode = {
  children: [
    { href: ADMIN_USERS_BASE, icon: "i-users", id: "users", label: "admin.nav.users", permission: permissionName("users", "read") },