From e2874528cd02c2b6b8b4dc374af417bb8901bf38 Mon Sep 17 00:00:00 2001
From: Marcel <marcel@familienarchiv>
Date: Fri, 20 Mar 2026 16:31:21 +0100
Subject: [PATCH] fix(conversations): hide new document link for read-only
 users

The link navigates to a page that requires WRITE_ALL. Guard it with
data.canWrite (supplied by the layout) so read-only users never see a
link that leads to a 403.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .../src/routes/conversations/+page.svelte     | 24 ++++++++++---------
 1 file changed, 13 insertions(+), 11 deletions(-)

diff --git a/frontend/src/routes/conversations/+page.svelte b/frontend/src/routes/conversations/+page.svelte
index 436667ec..58fd946f 100644
--- a/frontend/src/routes/conversations/+page.svelte
+++ b/frontend/src/routes/conversations/+page.svelte
@@ -225,17 +225,19 @@ const enrichedDocuments = $derived(
 					{data.documents.length}
 				</p>
 			{/if}
-			<a
-				data-testid="conv-new-doc-link"
-				href="/documents/new?senderId={senderId}&receiverId={receiverId}"
-				class="inline-flex items-center gap-1 text-sm font-medium text-brand-navy/60 transition-colors hover:text-brand-navy"
-			>
-				<svg class="h-4 w-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
-					<path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 4v16m8-8H4"
-					></path>
-				</svg>
-				{m.conv_new_doc_link()}
-			</a>
+			{#if data.canWrite}
+				<a
+					data-testid="conv-new-doc-link"
+					href="/documents/new?senderId={senderId}&receiverId={receiverId}"
+					class="inline-flex items-center gap-1 text-sm font-medium text-brand-navy/60 transition-colors hover:text-brand-navy"
+				>
+					<svg class="h-4 w-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+						<path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 4v16m8-8H4"
+						></path>
+					</svg>
+					{m.conv_new_doc_link()}
+				</a>
+			{/if}
 		</div>
 
 		<!-- CHAT CONTAINER -->