From ac12b04aada033117f9f7e8ee4fb9562c7d5a417 Mon Sep 17 00:00:00 2001
From: Classic298 <27028174+Classic298@users.noreply.github.com>
Date: Fri, 23 Oct 2026 03:58:17 +0200
Subject: [PATCH] fix: access button shows while sharing is not allowed
 (#32979)

The Access button in the model, prompt, tool, knowledge, skill and note editors, the Access entry in their list menus and the Access button in folder settings showed to users without the matching sharing permission. The dialog then had nothing they could change. The button and the menu entry now only show to users who may share that kind of item, and admins see them as before.

Refs #32830
---
 .../layout/Sidebar/Folders/FolderModal.svelte  |  2 +-
 src/lib/components/notes/NoteEditor.svelte     | 18 ++++++++++--------
 src/lib/components/notes/Notes.svelte          |  8 ++++++--
 src/lib/components/workspace/Knowledge.svelte  |  5 ++++-
 .../workspace/Knowledge/KnowledgeBase.svelte   |  6 +++---
 src/lib/components/workspace/Models.svelte     |  5 ++++-
 .../workspace/Models/ModelEditor.svelte        |  4 +++-
 src/lib/components/workspace/Prompts.svelte    |  4 +++-
 .../workspace/Prompts/PromptEditor.svelte      |  4 +++-
 src/lib/components/workspace/Skills.svelte     |  5 ++++-
 .../workspace/Skills/SkillEditor.svelte        |  4 +++-
 src/lib/components/workspace/Tools.svelte      |  4 +++-
 .../workspace/Tools/ToolkitEditor.svelte       | 14 ++++++++------
 13 files changed, 55 insertions(+), 28 deletions(-)

diff --git a/src/lib/components/layout/Sidebar/Folders/FolderModal.svelte b/src/lib/components/layout/Sidebar/Folders/FolderModal.svelte
index ddff2e2246..16469fc5bf 100644
--- a/src/lib/components/layout/Sidebar/Folders/FolderModal.svelte
+++ b/src/lib/components/layout/Sidebar/Folders/FolderModal.svelte
@@ -137,7 +137,7 @@
 				{/if}
 			</div>
 			<div class="flex items-center gap-1">
-				{#if edit && folder && ($user?.role === 'admin' || folder.user_id === $user?.id)}
+				{#if edit && folder && ($user?.role === 'admin' || (folder.user_id === $user?.id && $user?.permissions?.sharing?.folders))}
 					<AccessButton disabled={loading} on:click={() => (showAccessModal = true)} />
 				{/if}
 				<button
diff --git a/src/lib/components/notes/NoteEditor.svelte b/src/lib/components/notes/NoteEditor.svelte
index 7f74de0854..a3a19b0d01 100644
--- a/src/lib/components/notes/NoteEditor.svelte
+++ b/src/lib/components/notes/NoteEditor.svelte
@@ -1272,14 +1272,16 @@ ${content}
 								</NoteMenu>
 
 								{#if note?.write_access}
-									<div class="ml-1.5">
-										<AccessButton
-											on:click={() => {
-												showAccessControlModal = true;
-											}}
-											disabled={note?.user_id !== $user?.id && $user?.role !== 'admin'}
-										/>
-									</div>
+									{#if $user?.permissions?.sharing?.notes || $user?.role === 'admin'}
+										<div class="ml-1.5">
+											<AccessButton
+												on:click={() => {
+													showAccessControlModal = true;
+												}}
+												disabled={note?.user_id !== $user?.id && $user?.role !== 'admin'}
+											/>
+										</div>
+									{/if}
 								{:else}
 									<div class="shrink-0 text-xs text-gray-500 px-2 py-1">
 										{$i18n.t('Read-Only Access')}
diff --git a/src/lib/components/notes/Notes.svelte b/src/lib/components/notes/Notes.svelte
index 20e9690771..e8de9686bb 100644
--- a/src/lib/components/notes/Notes.svelte
+++ b/src/lib/components/notes/Notes.svelte
@@ -681,7 +681,9 @@
 														</Tooltip>
 													{:else}
 														<NoteMenu
-															onAccess={note.user_id === $user?.id || $user?.role === 'admin'
+															onAccess={(note.user_id === $user?.id &&
+																$user?.permissions?.sharing?.notes) ||
+															$user?.role === 'admin'
 																? () => accessModal.open(note.id)
 																: null}
 															show={openNoteMenuId === note.id}
@@ -772,7 +774,9 @@
 														</Tooltip>
 													{:else}
 														<NoteMenu
-															onAccess={note.user_id === $user?.id || $user?.role === 'admin'
+															onAccess={(note.user_id === $user?.id &&
+																$user?.permissions?.sharing?.notes) ||
+															$user?.role === 'admin'
 																? () => accessModal.open(note.id)
 																: null}
 															onDownload={(type) => {
diff --git a/src/lib/components/workspace/Knowledge.svelte b/src/lib/components/workspace/Knowledge.svelte
index ab04cea0f8..8ffdc4acab 100644
--- a/src/lib/components/workspace/Knowledge.svelte
+++ b/src/lib/components/workspace/Knowledge.svelte
@@ -536,7 +536,10 @@
 								{#if item?.write_access || $user?.role === 'admin'}
 									<div class="ml-2 flex shrink-0 flex-row items-center self-center">
 										<ItemMenu
-											accessHandler={() => accessModal.open(item.id)}
+											accessHandler={$user?.permissions?.sharing?.knowledge ||
+											$user?.role === 'admin'
+												? () => accessModal.open(item.id)
+												: null}
 											onExport={$user?.role === 'admin'
 												? () => {
 														exportHandler(item);
diff --git a/src/lib/components/workspace/Knowledge/KnowledgeBase.svelte b/src/lib/components/workspace/Knowledge/KnowledgeBase.svelte
index 537e6c0185..12473a7189 100644
--- a/src/lib/components/workspace/Knowledge/KnowledgeBase.svelte
+++ b/src/lib/components/workspace/Knowledge/KnowledgeBase.svelte
@@ -873,9 +873,9 @@
 				><ChevronLeft className="size-3" strokeWidth="2" />{$i18n.t('Back')}</button
 			>
 			<!-- Previous file count label: {$i18n.t('{{COUNT}} files')} -->
-			{#if knowledge.write_access}<AccessButton
-					on:click={() => (showAccessControlModal = true)}
-				/>{:else}<span class="text-xs text-gray-500">{$i18n.t('Read Only')}</span>{/if}
+			{#if knowledge.write_access}{#if $user?.permissions?.sharing?.knowledge || $user?.role === 'admin'}<AccessButton
+						on:click={() => (showAccessControlModal = true)}
+					/>{/if}{:else}<span class="text-xs text-gray-500">{$i18n.t('Read Only')}</span>{/if}
 		</div>
 		<div class="shrink-0 px-1 pb-2.5">
 			<input
diff --git a/src/lib/components/workspace/Models.svelte b/src/lib/components/workspace/Models.svelte
index 63f9c7cceb..1e3544e5ee 100644
--- a/src/lib/components/workspace/Models.svelte
+++ b/src/lib/components/workspace/Models.svelte
@@ -940,7 +940,10 @@
 									{:else}
 										<div class="flex shrink-0 flex-row items-center gap-1 self-center">
 											<ModelMenu
-												accessHandler={() => accessModal.open(model.id)}
+												accessHandler={$user?.permissions?.sharing?.models ||
+												$user?.role === 'admin'
+													? () => accessModal.open(model.id)
+													: null}
 												user={$user}
 												{model}
 												writeAccess={model.write_access}
diff --git a/src/lib/components/workspace/Models/ModelEditor.svelte b/src/lib/components/workspace/Models/ModelEditor.svelte
index 9f4999d396..d234cf2b39 100644
--- a/src/lib/components/workspace/Models/ModelEditor.svelte
+++ b/src/lib/components/workspace/Models/ModelEditor.svelte
@@ -871,7 +871,9 @@
 						{translatedLocales}
 						className="w-fit"
 					/>
-					<AccessButton on:click={() => (showAccessControlModal = true)} />
+					{#if $user?.permissions?.sharing?.models || $user?.role === 'admin'}
+						<AccessButton on:click={() => (showAccessControlModal = true)} />
+					{/if}
 				</div>
 			{/if}
 		</div>
diff --git a/src/lib/components/workspace/Prompts.svelte b/src/lib/components/workspace/Prompts.svelte
index 4682b0fa8a..4005819cb8 100644
--- a/src/lib/components/workspace/Prompts.svelte
+++ b/src/lib/components/workspace/Prompts.svelte
@@ -701,7 +701,9 @@
 
 									<div class="ml-0.5 flex shrink-0 flex-row items-center gap-1.5 self-center">
 										<PromptMenu
-											accessHandler={() => accessModal.open(prompt.id)}
+											accessHandler={$user?.permissions?.sharing?.prompts || $user?.role === 'admin'
+												? () => accessModal.open(prompt.id)
+												: null}
 											writeAccess={prompt.write_access}
 											show={openPromptMenuId === prompt.id}
 											editHandler={() => {
diff --git a/src/lib/components/workspace/Prompts/PromptEditor.svelte b/src/lib/components/workspace/Prompts/PromptEditor.svelte
index bbef4c7c93..882dfd29d1 100644
--- a/src/lib/components/workspace/Prompts/PromptEditor.svelte
+++ b/src/lib/components/workspace/Prompts/PromptEditor.svelte
@@ -458,7 +458,9 @@
 				</button>
 			{/if}
 			<div class="flex shrink-0 items-center gap-1 pr-0.5">
-				{#if !disabled}<AccessButton on:click={() => (showAccessControlModal = true)} />
+				{#if !disabled}{#if $user?.permissions?.sharing?.prompts || $user?.role === 'admin'}<AccessButton
+							on:click={() => (showAccessControlModal = true)}
+						/>{/if}
 				{:else}<span class="px-2 py-1 text-xs text-gray-500">{$i18n.t('Read Only')}</span>{/if}
 				{#if modal}<button
 						type="button"
diff --git a/src/lib/components/workspace/Skills.svelte b/src/lib/components/workspace/Skills.svelte
index 75ea3a7f52..674e497a2e 100644
--- a/src/lib/components/workspace/Skills.svelte
+++ b/src/lib/components/workspace/Skills.svelte
@@ -607,7 +607,10 @@
 										<div class="flex shrink-0 flex-row items-center gap-1.5 self-center">
 											<SkillMenu
 												shareHandler={() => shareHandler(skill)}
-												accessHandler={() => accessModal.open(skill.id)}
+												accessHandler={$user?.permissions?.sharing?.skills ||
+												$user?.role === 'admin'
+													? () => accessModal.open(skill.id)
+													: null}
 												show={openSkillMenuId === skill.id}
 												editHandler={() => {
 													goto(`/workspace/skills/edit?id=${encodeURIComponent(skill.id)}`);
diff --git a/src/lib/components/workspace/Skills/SkillEditor.svelte b/src/lib/components/workspace/Skills/SkillEditor.svelte
index 2b5ebad65b..0bfd10064e 100644
--- a/src/lib/components/workspace/Skills/SkillEditor.svelte
+++ b/src/lib/components/workspace/Skills/SkillEditor.svelte
@@ -358,7 +358,9 @@
 			<div class="flex shrink-0 items-center gap-1 pr-0.5">
 				<LanguageModeSelect bind:value={locale} translatedLocales={Object.keys(meta.i18n ?? {})} />
 				{#if !disabled}
-					<AccessButton on:click={() => (showAccessControlModal = true)} />
+					{#if $user?.permissions?.sharing?.skills || $user?.role === 'admin'}
+						<AccessButton on:click={() => (showAccessControlModal = true)} />
+					{/if}
 				{:else}
 					<span class="rounded-lg bg-gray-100 px-2 py-1 text-xs text-gray-500 dark:bg-gray-850">
 						{$i18n.t('Read Only')}
diff --git a/src/lib/components/workspace/Tools.svelte b/src/lib/components/workspace/Tools.svelte
index 0a18d86072..5ee8e054ef 100644
--- a/src/lib/components/workspace/Tools.svelte
+++ b/src/lib/components/workspace/Tools.svelte
@@ -599,7 +599,9 @@
 										</Tooltip>
 
 										<ToolMenu
-											accessHandler={() => accessModal.open(tool.id)}
+											accessHandler={$user?.permissions?.sharing?.tools || $user?.role === 'admin'
+												? () => accessModal.open(tool.id)
+												: null}
 											show={openToolMenuId === tool.id}
 											editHandler={() => {
 												goto(`/workspace/tools/edit?id=${encodeURIComponent(tool.id)}`);
diff --git a/src/lib/components/workspace/Tools/ToolkitEditor.svelte b/src/lib/components/workspace/Tools/ToolkitEditor.svelte
index ab04832c61..a3e7f89c79 100644
--- a/src/lib/components/workspace/Tools/ToolkitEditor.svelte
+++ b/src/lib/components/workspace/Tools/ToolkitEditor.svelte
@@ -353,12 +353,14 @@ class Tools:
 						pruneEmptyLocaleEntries(selected ? selected.snapshot.meta.i18n : meta.i18n)
 					)}
 				/>
-				<AccessButton
-					disabled={!!selected || loading || selecting || promoting}
-					on:click={() => {
-						showAccessControlModal = true;
-					}}
-				/>
+				{#if $user?.permissions?.sharing?.tools || $user?.role === 'admin'}
+					<AccessButton
+						disabled={!!selected || loading || selecting || promoting}
+						on:click={() => {
+							showAccessControlModal = true;
+						}}
+					/>
+				{/if}
 			</div>
 		</div>