The sharePublic prop in editor components (Knowledge, Tools, Skills,
Prompts, Models) incorrectly included an "|| edit" / "|| write_access"
condition, allowing users with write access to see and use the "Public"
sharing option regardless of their actual public sharing permission.
Additionally, all backend access/update endpoints only verified write
authorization but did not check the corresponding sharing.public_*
permission, allowing direct API calls to bypass frontend restrictions
entirely.
Frontend: removed the edit/write_access bypass from sharePublic in all
five editor components so visibility is gated solely by the user's
sharing.public_* permission or admin role.
Backend: added has_public_read_access_grant checks to the access/update
endpoints in knowledge.py, tools.py, prompts.py, skills.py, models.py,
and notes.py. Public grants are silently stripped when the user lacks
the corresponding permission.
Fixes#21356
* feat: Add read-only access support for Prompts
- Backend: Add write_access field to PromptAccessResponse
- Backend: Update /prompts/list to return prompts with write_access
- Frontend: Display Read Only badge in Prompts list
- Frontend: Disable inputs and save button when no write access
* feat: Add read-only visual indicators for Prompts workspace
* fix: Return write_access from getPromptByCommand endpoint
- Backend returns write_access directly in response
- Frontend extracts write_access from getPromptByCommand response
- Remove inefficient getPromptList call in edit page
* fix: Align Read Only badge to right in Prompts.svelte
- Title and command stay on left
- Badge pushed to right by justify-between
* fix: Use PromptAccessResponse in get_prompt_by_command endpoint
fix: Use PromptAccessResponse in get_prompt_by_command endpoint
- Return PromptAccessResponse Pydantic model instead of raw dict
- Properly type the response with response_model
Fix implicit None returns in get_model_by_id, get_knowledge_by_id, get_tools_by_id, and get_prompt_by_command. Now properly returns 401 for access denied and 404 for not found instead of silently returning None.
* feat: add granular import/export permissions for workspace items (#55)
Co-authored-by: Claude <noreply@anthropic.com>
* Fix permissions toggles not saving in EditGroupModal (#58)
Co-authored-by: Claude <noreply@anthropic.com>
* Fix permissions toggles not saving in EditGroupModal (#59)
Co-authored-by: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
