Several mutation entry points stayed visible to users who lacked the
backend-required role, so Viewers (and non-creator Contributors) hit
403 on click instead of seeing the disabled state. Surgical fixes,
all matching the existing backend matrix:
- KnowledgeBaseList: gate the entire 3-dot popup (both the 'all'
and 'mine' tabs) behind canManageKBCard. Pin/unpin used to be
unguarded; settings/delete were per-item gated but the trigger
still showed. Now non-managers don't see the popup at all.
- AgentList: the popup trigger now requires at least one menu item
to be visible (edit OR copy OR disable OR delete), via a compound
v-if on the popup itself. Disable/enable on own custom agents
and shared agents both gain a hasRole('admin') guard to match
POST /shared-agents/disabled, which writes a tenant-level
preference and is Admin-gated.
- AgentEditorModal: new readOnly prop hides the '确定' (save)
button and replaces 'Cancel' with 'Close'. AgentList passes
readOnly when the user can't manage the agent (built-in agents
and others' custom agents for Viewers). Form-input disabling is
intentionally NOT wired here yet — the modal has 3000+ lines of
inputs and the only mutation surface that 403s is the save
button. Hiding it removes the broken path without rewiring the
whole form.
- doc-content: generated-question delete button gated by a new
canEditKB prop driven by KnowledgeBase.vue's existing canEdit
computed (KB creator OR Admin OR org-share-edit). Defaults to
Admin-only when the prop is missing — fail-closed since the
backend matrix is now stricter (see follow-up commit).
The server still enforces the same matrix on every mutation; these
gates only stop the user from staring at a 'failed' toast.
wizardchen
f7a264ca93