Gate read-only actions and clarify optional notes field - #35
Merged
Conversation
Read-only tracker members no longer see trackers they can't add content to in the quick-add sheet, nor booking/skip actions on the dashboard's schedule forecast, matching the schedules page's existing permission gating. Also labels transaction note fields as "(optional)" for consistency with schedule note templates, and swaps the placeholder payee text from "Ohne Angabe" to "Anonym". Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
📝 WalkthroughWalkthroughThe changes add permission-aware tracker selection and scheduled-item actions, preserve tracker ordering in client caches, and standardize missing-payee and optional-notes labels across transaction interfaces. ChangesTracker permissions and transaction presentation
Estimated code review effort: 2 (Simple) | ~10 minutes Sequence Diagram(s)sequenceDiagram
participant User
participant QuickAddSheet
participant DashboardClient
User->>QuickAddSheet: Open transaction or appointment flow
QuickAddSheet->>QuickAddSheet: Filter archived and read-only trackers
User->>DashboardClient: View scheduled tracker items
DashboardClient->>DashboardClient: Check active tracker permission
DashboardClient-->>User: Show permitted scheduled-item actions
Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Owner
Author
|
@coderabbitai help |
ChatThere are 3 ways to chat with CodeRabbit:
CodeRabbit commands
Other keywords and placeholders
CodeRabbit configuration file (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@components/layout/quick-add-sheet.tsx`:
- Around line 103-105: Update the active tracker selection logic near
selectableTrackers so the remembered selectedTrackerId is used only when it
matches a tracker in selectableTrackers; otherwise fall back to the existing
valid tracker selection behavior. Ensure resetForm cannot leave a read-only or
otherwise filtered-out tracker as the active submission target.
- Line 49: Make permission handling fail closed and consistent with the server
contract: in components/layout/quick-add-sheet.tsx lines 49-49, require the
permission value or explicitly represent unknown permission; at lines 103-105,
filter through canWriteTracker/canCreateTrackerContent or the equivalent
canonical predicate. In components/dashboard/dashboard-client.tsx line 290,
derive canCreateContent from that same predicate, and at line 848 keep scheduled
actions gated by the corrected boolean.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: cb3cf3ab-b7c1-4172-9ae1-85b1ad2ca07f
📒 Files selected for processing (6)
app/t/[slug]/page.tsxcomponents/dashboard/dashboard-client.tsxcomponents/layout/quick-add-sheet.tsxcomponents/transactions/entity-picker.tsxcomponents/transactions/transaction-edit.tsxcomponents/transactions/transactions-client.tsx
| color: string; | ||
| currency: string; | ||
| isActive: boolean; | ||
| permission?: "owner" | "admin" | "write" | "read"; |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Keep UI permission checks aligned with the server contract.
Both UI paths treat any value other than literal "read" as writable, including missing permission data. Use canWriteTracker/canCreateTrackerContent or an equivalent fail-closed allowlist.
components/layout/quick-add-sheet.tsx#L49-L49: make permission required if the API guarantees it, or explicitly model unknown permission.components/layout/quick-add-sheet.tsx#L103-L105: filter using the canonical write-capability predicate.components/dashboard/dashboard-client.tsx#L290-L290: derivecanCreateContentfrom that same predicate.components/dashboard/dashboard-client.tsx#L848-L848: keep scheduled actions behind the corrected boolean.
📍 Affects 2 files
components/layout/quick-add-sheet.tsx#L49-L49(this comment)components/layout/quick-add-sheet.tsx#L103-L105components/dashboard/dashboard-client.tsx#L290-L290components/dashboard/dashboard-client.tsx#L848-L848
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@components/layout/quick-add-sheet.tsx` at line 49, Make permission handling
fail closed and consistent with the server contract: in
components/layout/quick-add-sheet.tsx lines 49-49, require the permission value
or explicitly represent unknown permission; at lines 103-105, filter through
canWriteTracker/canCreateTrackerContent or the equivalent canonical predicate.
In components/dashboard/dashboard-client.tsx line 290, derive canCreateContent
from that same predicate, and at line 848 keep scheduled actions gated by the
corrected boolean.
Comment on lines
+103
to
+105
| const selectableTrackers = trackers.filter( | ||
| (t) => t.isActive && t.permission !== "read", | ||
| ); |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Revalidate the remembered tracker selection after filtering.
activeTrackerId still prefers selectedTrackerId, and resetForm does not clear it. If the selected tracker becomes read-only, it remains active even though it is no longer in selectableTrackers, allowing the form to submit for a tracker the sheet excludes. Derive the selected ID only when it remains selectable.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@components/layout/quick-add-sheet.tsx` around lines 103 - 105, Update the
active tracker selection logic near selectableTrackers so the remembered
selectedTrackerId is used only when it matches a tracker in selectableTrackers;
otherwise fall back to the existing valid tracker selection behavior. Ensure
resetForm cannot leave a read-only or otherwise filtered-out tracker as the
active submission target.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Test plan
npx tsc --noEmitpassesnpx eslintpasses on changed filesreadpermission does not see it listed in the quick-add sheet's tracker pickerreadpermission user does not see book/skip buttons on the dashboard's upcoming schedules🤖 Generated with Claude Code
Summary by CodeRabbit
New Features
UI Improvements