mirror of
https://github.com/ancsemi/Haven.git
synced 2026-11-03 04:25:23 +00:00
ancsemi
128ee742b5
birdcrazy confirmed the #5433 scoping fix works (sub-channel rename and top-level create are both correctly restricted server-side now), but flagged a remaining UI issue: the always-visible sidebar "Create Channel" section still shows up for a user who only holds create_channel inside one sub-channel, even though every submission from that box creates a top-level channel and gets denied. It's a dead control. Root cause: the flat permissions list sent to the client (getUserPermissions) mixes server-wide and channel-scoped grants together on purpose, since it also drives per-channel UI like context-menu buttons. The sidebar section is different — it always performs a server-wide action regardless of which channel is active, so it needs a global-only signal. Added getUserGlobalPermissions(), identical to getUserPermissions but excluding any role assignment or override with a non-null channel_id, sent alongside the existing permissions array as globalPermissions in session-info and roles-updated. Client gates the Create Channel section on a new _hasGlobalPerm() helper instead of _hasPerm(); every other create_channel check (context menus, per-channel settings) is untouched since those are correctly channel-context-aware already.