marcel/familienarchiv
1
0
Fork 0
Code Issues 111 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

fix(conversations): hide new document link for read-only users

Browse Source 
The link navigates to a page that requires WRITE_ALL. Guard it with
data.canWrite (supplied by the layout) so read-only users never see a
link that leads to a 403.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Marcel
2026-03-20 16:31:21 +01:00
parent aa127de9bd
commit e2874528cd
1 changed files with 13 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
frontend/src/routes/conversations/+page.svelte
View File

@@ -225,17 +225,19 @@ const enrichedDocuments = $derived(
{data.documents.length} {data.documents.length}
</p> </p>
{/if} {/if}
<a {#if data.canWrite}
data-testid="conv-new-doc-link" <a
href="/documents/new?senderId={senderId}&receiverId={receiverId}" data-testid="conv-new-doc-link"
class="inline-flex items-center gap-1 text-sm font-medium text-brand-navy/60 transition-colors hover:text-brand-navy" href="/documents/new?senderId={senderId}&receiverId={receiverId}"
> class="inline-flex items-center gap-1 text-sm font-medium text-brand-navy/60 transition-colors hover:text-brand-navy"
<svg class="h-4 w-4" fill="none" stroke="currentColor" viewBox="0 0 24 24"> >
<path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 4v16m8-8H4" <svg class="h-4 w-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
></path> <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 4v16m8-8H4"
</svg> ></path>
{m.conv_new_doc_link()} </svg>
</a> {m.conv_new_doc_link()}
</a>
{/if}
</div> </div>
<!-- CHAT CONTAINER --> <!-- CHAT CONTAINER -->