From 2970b057b2070dc7afd497e70e33a6aea626f55b Mon Sep 17 00:00:00 2001 From: "Amy J. Ko" Date: Sat, 7 Nov 2026 15:00:55 -0800 Subject: [PATCH] Use one rule for who can see the whole organization. Roles, assignments and processes are readable by members, or by anyone if the org is public. Several pages instead required logged-out viewers for public orgs and members otherwise, so logged-in non-members of a public org were told it was private. Define the rule once in the org context and use it everywhere. Keep the change status editor for members only. Co-Authored-By: Claude Opus 5.5 --- CHANGELOG | 6 ++++++ package-lock.json | 4 ++-- package.json | 2 +- src/lib/ARCI.svelte | 5 ++--- src/lib/Changes.svelte | 9 ++++----- src/routes/org/[orgid]/+layout.svelte | 7 +++++++ src/routes/org/[orgid]/process/[processid]/+page.svelte | 3 +-- src/routes/org/[orgid]/processes/+page.svelte | 4 +--- src/routes/org/[orgid]/role/[roleid]/+page.svelte | 4 +--- src/routes/org/[orgid]/roles/+page.svelte | 9 ++------- 10 files changed, 27 insertions(+), 26 deletions(-) diff --git a/CHANGELOG b/CHANGELOG index 1a04e00..34a20aa 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -3,6 +3,12 @@ We'll document all notable changes in this file, including bug fixes, enhancements, and dependency updates. Dates should be in`YYYY-MM-DD` format and versions are in [semantic versioning](http://semver.org/) format. +## v0.10.7 2026-11-07 + +### Fixed + +- People who aren't members of a public organization can now see its roles and who holds them. + ## v0.10.6 2026-11-07 ### Fixed diff --git a/package-lock.json b/package-lock.json index 758162f..c50f1c4 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "adminima", - "version": "0.10.6", + "version": "0.10.7", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "adminima", - "version": "0.10.6", + "version": "0.10.7", "dependencies": { "@supabase/ssr": "^0", "@sveltejs/adapter-vercel": "^7", diff --git a/package.json b/package.json index cb28860..5483e59 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "adminima", - "version": "0.10.6", + "version": "0.10.7", "private": true, "scripts": { "dev": "vite dev", diff --git a/src/lib/ARCI.svelte b/src/lib/ARCI.svelte index 49e02a1..fef140c 100644 --- a/src/lib/ARCI.svelte +++ b/src/lib/ARCI.svelte @@ -20,9 +20,8 @@ const orgContext = getOrg(); - // Mirrors the roles RLS policy: only members, or anyone if the org is public, can see its roles. - // Without them, every assignment would render as "Unknown role", so show nothing instead. - let canSeeRoles = $derived(orgContext().member || orgContext().org.visibility === 'public'); + // Without the org's roles, every assignment would render as "Unknown role", so show nothing. + let canSeeRoles = $derived(orgContext().visible); const dbContext = getDB(); const db = $derived(dbContext()); diff --git a/src/lib/Changes.svelte b/src/lib/Changes.svelte index c3b802d..fa79f03 100644 --- a/src/lib/Changes.svelte +++ b/src/lib/Changes.svelte @@ -40,7 +40,6 @@ let { changes, profiles, children }: Props = $props(); const context = getOrg(); - let org = $derived(context().org); const dbContext = getDB(); const db = $derived(dbContext()); @@ -48,9 +47,9 @@ const user = getUser(); const Levels = { triage: 0, active: 1, blocked: 2, done: 4, backlog: 3, declined: 5 }; - let visible = $derived( - ($user === null && org.visibility === 'public') || ($user !== null && context().member) - ); + let visible = $derived(context().visible); + // Only members can change a change's status; everyone else sees it read-only. + let canEditStatus = $derived($user !== null && context().member); let filterText = $state(getInitialTextFilter()); let filterStatus = $state(getInitialStatusFilter()); @@ -214,7 +213,7 @@ {@const comment = latestComments.find((c) => c.id === change.comments.at(-1))} {#if visible} + >{#if canEditStatus}