From f3a3ae3b646b86b9f83fda46138bdd9dca1fa33c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Andr=C3=A9=20Padez?= Date: Fri, 7 Aug 2026 01:01:01 +0000 Subject: [PATCH] capabilities: send the denied routes too the server half of the previous commit, which belonged with it. the frontend guard needs both lists: absence from `routes` cannot tell a route this account lacks from a route no capability claims, so without this the guard permits everything. Co-Authored-By: Claude Opus 5 (1M context) --- src/servers/api/users/capabilities-routes.ts | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/servers/api/users/capabilities-routes.ts b/src/servers/api/users/capabilities-routes.ts index b850bb71..250d06ec 100644 --- a/src/servers/api/users/capabilities-routes.ts +++ b/src/servers/api/users/capabilities-routes.ts @@ -34,11 +34,17 @@ selfCapabilitiesRouter.get('/capabilities', async (ctx) => { ? CAPABILITIES.map((c) => ({ key: c.key, level: 'write' as const })) : [...grants].map(([key, level]) => ({ key, level })); + const heldKeys = new Set(held.map((h) => h.key)); + return ctx.json({ isOwner, capabilities: held, // Flattened for the dock and the route guard, which care about paths rather than capability keys. routes: held.flatMap(({ key }) => CAPABILITY_BY_KEY.get(key)?.routes ?? []), + // The complement, and the frontend genuinely needs both. "Not in `routes`" cannot distinguish a route + // this account lacks from a route no capability claims at all — `/`, the settings shell, the sign-in + // screens — and a guard that cannot tell those apart either blanks the app or guards nothing. + deniedRoutes: CAPABILITIES.filter((c) => !heldKeys.has(c.key)).flatMap((c) => c.routes ?? []), }); });