From 97274beba003f4be2ceba2257c5e4656e1796d08 Mon Sep 17 00:00:00 2001 From: Marcel Date: Sun, 31 May 2026 11:08:51 +0200 Subject: [PATCH] test(layout): lock upload-button gate against ANNOTATE_ALL-only users (#696) Documents that the gate keys on lack of WRITE_ALL, not on being READ_ALL: an ANNOTATE_ALL-only user (canWrite=false) must still not see the upload link. The writer-sees-it contract is already covered by the existing upload-link tests. Co-Authored-By: Claude Sonnet 4.6 --- frontend/src/routes/layout.svelte.spec.ts | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/frontend/src/routes/layout.svelte.spec.ts b/frontend/src/routes/layout.svelte.spec.ts index dc8c50d2..e0594d1f 100644 --- a/frontend/src/routes/layout.svelte.spec.ts +++ b/frontend/src/routes/layout.svelte.spec.ts @@ -90,6 +90,16 @@ describe('Layout – upload link', () => { .element(page.getByRole('link', { name: /Hochladen|Upload|Subir/i })) .not.toBeInTheDocument(); }); + + it('is hidden for an ANNOTATE_ALL-only user (gate is lack of WRITE_ALL, not READ_ALL)', async () => { + render(Layout, { + data: makeData({ canWrite: false, canAnnotate: true }), + children: emptySnippet + }); + await expect + .element(page.getByRole('link', { name: /Hochladen|Upload|Subir/i })) + .not.toBeInTheDocument(); + }); }); // ─── Dropdown ─────────────────────────────────────────────────────────────────