From 7c29032f2d8bb1264369eafd88b1d05c1aa1dc21 Mon Sep 17 00:00:00 2001
From: "Amy J. Ko" <ajko@uw.edu>
Date: Mon, 5 Oct 2026 09:06:54 -0700
Subject: [PATCH 1/2] Fix Internal Error on process pages for logged-out
 viewers.

Since roles became private for non-public orgs, anonymous viewers can't
resolve role references in step text, so ReferenceView fell back to an
inline Oops. Oops always rendered a <div>, which inside a markup <p> is
invalid HTML; the browser re-parsed it, hydration failed, and SvelteKit
showed "Internal Error".

- Oops renders a <span> when inline.
- Non-members see unresolved references as plain text instead of an error.
- The process page queried changes by org id instead of process id, so
  its Changes section was always empty.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 CHANGELOG                                           | 7 +++++++
 package-lock.json                                   | 4 ++--
 package.json                                        | 2 +-
 src/lib/Oops.svelte                                 | 7 ++++---
 src/lib/ReferenceView.svelte                        | 3 +++
 src/routes/org/[orgid]/process/[processid]/+page.ts | 2 +-
 6 files changed, 18 insertions(+), 7 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index b7cdfe2..76feecd 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -3,6 +3,13 @@
 We'll document all notable changes in this file, including bug fixes, enhancements, and dependency updates.
 Dates should be in`YYYY-MM-DD` format and versions are in [semantic versioning](http://semver.org/) format.
 
+## v0.10.3 2026-10-05
+
+### Fixed
+
+- Process pages no longer show "Internal Error" to people who aren't logged in.
+- Process pages now list the changes suggested for that process.
+
 ## v0.10.2 2026-09-20
 
 ### Changed
diff --git a/package-lock.json b/package-lock.json
index c0ec7f9..f7d69ef 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
 	"name": "adminima",
-	"version": "0.10.2",
+	"version": "0.10.3",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "adminima",
-			"version": "0.10.2",
+			"version": "0.10.3",
 			"dependencies": {
 				"@supabase/ssr": "^0",
 				"@sveltejs/adapter-vercel": "^6",
diff --git a/package.json b/package.json
index d5c1e37..a9c333b 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "adminima",
-	"version": "0.10.2",
+	"version": "0.10.3",
 	"private": true,
 	"scripts": {
 		"dev": "vite dev",
diff --git a/src/lib/Oops.svelte b/src/lib/Oops.svelte
index bf44279..c783d0e 100644
--- a/src/lib/Oops.svelte
+++ b/src/lib/Oops.svelte
@@ -8,13 +8,14 @@
 	let { text = undefined, inline = false, children }: Props = $props();
 </script>
 
-<div class:inline>
+<!-- A span when inline, since a div inside a paragraph is invalid HTML and breaks hydration. -->
+<svelte:element this={inline ? 'span' : 'div'} class="oops" class:inline>
 	{#if text}<span>{typeof text === 'string' ? text : 'Error'}</span>{/if}
 	<span class="sub">{@render children?.()}</span>
-</div>
+</svelte:element>
 
 <style>
-	div {
+	.oops {
 		display: flex;
 		flex-direction: column;
 		background: var(--error);
diff --git a/src/lib/ReferenceView.svelte b/src/lib/ReferenceView.svelte
index 2c312c7..647c0e8 100644
--- a/src/lib/ReferenceView.svelte
+++ b/src/lib/ReferenceView.svelte
@@ -23,6 +23,9 @@
 	<RoleLink {role} />
 {:else if process}
 	<ProcessLink {process} />
+{:else if !context().member}
+	<!-- Non-members may not be able to see the org's roles, so just show the name. -->
+	{segment.target}
 {:else}
 	<!-- Say so, rather than rendering a link that silently goes nowhere. -->
 	<Oops inline text="Unknown role or process: {segment.target}" />
diff --git a/src/routes/org/[orgid]/process/[processid]/+page.ts b/src/routes/org/[orgid]/process/[processid]/+page.ts
index 1f7ebfc..7493ada 100644
--- a/src/routes/org/[orgid]/process/[processid]/+page.ts
+++ b/src/routes/org/[orgid]/process/[processid]/+page.ts
@@ -25,7 +25,7 @@ export async function load({ parent, params }) {
 	] = await Promise.all([
 		Organization.queryProcessHows(supabase, process.id),
 		Organization.queryRoles(supabase, org.id),
-		Organization.queryProcessChanges(supabase, org.id),
+		Organization.queryProcessChanges(supabase, process.id),
 		Organization.queryConcerns(supabase, org.id),
 		Organization.queryPersonRoles(supabase, org.id, uid),
 		Organization.queryProfiles(supabase, org.id)

From e9a5c8443306a1786bada5d4d275ddc63361d5ac Mon Sep 17 00:00:00 2001
From: "Amy J. Ko" <ajko@uw.edu>
Date: Mon, 5 Oct 2026 09:17:08 -0700
Subject: [PATCH 2/2] Hide process edit controls from non-members; show
 reference text.

When no role is accountable for a process, the page let anyone logged in
edit it, but RLS only allows members of the org. Outsiders saw edit
controls whose changes would fail. Require membership, matching RLS.

Non-members now see the text the author wrote for an unresolved
reference rather than its target.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 CHANGELOG                                               | 1 +
 src/lib/ReferenceView.svelte                            | 4 ++--
 src/routes/org/[orgid]/process/[processid]/+page.svelte | 4 +++-
 3 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 76feecd..b388973 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -9,6 +9,7 @@ Dates should be in`YYYY-MM-DD` format and versions are in [semantic versioning](
 
 - Process pages no longer show "Internal Error" to people who aren't logged in.
 - Process pages now list the changes suggested for that process.
+- People outside an organization no longer see edit controls on its processes.
 
 ## v0.10.2 2026-09-20
 
diff --git a/src/lib/ReferenceView.svelte b/src/lib/ReferenceView.svelte
index 647c0e8..c4246be 100644
--- a/src/lib/ReferenceView.svelte
+++ b/src/lib/ReferenceView.svelte
@@ -24,8 +24,8 @@
 {:else if process}
 	<ProcessLink {process} />
 {:else if !context().member}
-	<!-- Non-members may not be able to see the org's roles, so just show the name. -->
-	{segment.target}
+	<!-- Non-members may not be able to see the org's roles, so just show the text the author wrote. -->
+	{segment.text}
 {:else}
 	<!-- Say so, rather than rendering a link that silently goes nowhere. -->
 	<Oops inline text="Unknown role or process: {segment.target}" />
diff --git a/src/routes/org/[orgid]/process/[processid]/+page.svelte b/src/routes/org/[orgid]/process/[processid]/+page.svelte
index f787dff..6542222 100644
--- a/src/routes/org/[orgid]/process/[processid]/+page.svelte
+++ b/src/routes/org/[orgid]/process/[processid]/+page.svelte
@@ -67,10 +67,12 @@
 
 	// This mirrors the row-level security policy: only admins and people with an accountable or responsible role can edit this policy.
 	let isAdmin = $derived(orgContext().admin);
+	let isMember = $derived(orgContext().member);
 	let accountable = $derived(
 		$user !== null &&
 			process !== null &&
-			(process.accountable === null || personRoles.includes(process.accountable))
+			// If no one is accountable, anyone in the org can edit it, not anyone logged in.
+			(process.accountable === null ? isMember : personRoles.includes(process.accountable))
 	);
 	let responsible = $derived(
 		$user !== null &&