From 44f184d50580f4ad8988ce87140c3b62183bc865 Mon Sep 17 00:00:00 2001
From: Debian <linux@myhorse.netcell-it.de>
Date: Thu, 28 May 2026 10:27:12 +0200
Subject: [PATCH] =?UTF-8?q?fix(users):=20viewer-Rolle=20=E2=80=94=20Add/Ed?=
 =?UTF-8?q?it/Delete/Set-PW/Active-Toggle=20deaktivieren?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Users-Seite fehlte `isViewer` komplett: Viewer sahen alle Mutations-
Controls aktiv und bekamen erst nach dem Klick einen Backend-403.
Jetzt: „Benutzer hinzufügen"-Button + KeyOutlined-Set-PW-Button +
Active-Switch tragen `disabled={isViewer}`, ActionButtons-Pair liest
isViewer schon intern aus dem Auth-Store.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 VERSION                                 |  2 +-
 cmd/edgeguard-api/main.go               |  2 +-
 cmd/edgeguard-ctl/main.go               |  2 +-
 cmd/edgeguard-scheduler/main.go         |  2 +-
 management-ui/src/pages/Users/index.tsx | 37 +++++++++++++++----------
 5 files changed, 26 insertions(+), 19 deletions(-)

diff --git a/VERSION b/VERSION
index b176d89..8c8b508 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1.1.122
+1.1.123
diff --git a/cmd/edgeguard-api/main.go b/cmd/edgeguard-api/main.go
index 9654e23..1f1219a 100644
--- a/cmd/edgeguard-api/main.go
+++ b/cmd/edgeguard-api/main.go
@@ -60,7 +60,7 @@ import (
 	usersvc "git.netcell-it.de/projekte/edgeguard-native/internal/services/users"
 )
 
-var version = "1.1.122"
+var version = "1.1.123"
 
 func main() {
 	addr := os.Getenv("EDGEGUARD_API_ADDR")
diff --git a/cmd/edgeguard-ctl/main.go b/cmd/edgeguard-ctl/main.go
index b1b772c..c66a338 100644
--- a/cmd/edgeguard-ctl/main.go
+++ b/cmd/edgeguard-ctl/main.go
@@ -11,7 +11,7 @@ import (
 	"git.netcell-it.de/projekte/edgeguard-native/internal/services/setup"
 )
 
-var version = "1.1.122"
+var version = "1.1.123"
 
 const usage = `edgeguard-ctl — EdgeGuard CLI
 
diff --git a/cmd/edgeguard-scheduler/main.go b/cmd/edgeguard-scheduler/main.go
index fa38cfb..26a2539 100644
--- a/cmd/edgeguard-scheduler/main.go
+++ b/cmd/edgeguard-scheduler/main.go
@@ -41,7 +41,7 @@ import (
 	"git.netcell-it.de/projekte/edgeguard-native/internal/services/tlscerts"
 )
 
-var version = "1.1.122"
+var version = "1.1.123"
 
 const (
 	// renewTickInterval — how often we re-evaluate expiring certs.
diff --git a/management-ui/src/pages/Users/index.tsx b/management-ui/src/pages/Users/index.tsx
index ecae161..30dc208 100644
--- a/management-ui/src/pages/Users/index.tsx
+++ b/management-ui/src/pages/Users/index.tsx
@@ -41,6 +41,7 @@ export default function UsersPage() {
   const { t } = useTranslation()
   const qc = useQueryClient()
   const me = useAuthStore((s) => s.user)
+  const isViewer = me?.role === 'viewer'
 
   const { data: users, isLoading } = useQuery({ queryKey: ['users'], queryFn: listUsers })
 
@@ -109,6 +110,7 @@ export default function UsersPage() {
         <Switch
           size="small"
           checked={v}
+          disabled={isViewer}
           loading={quickToggle.isPending && quickToggle.variables?.id === row.id}
           onChange={(checked) => quickToggle.mutate({ id: row.id, row, checked })}
         />
@@ -128,8 +130,9 @@ export default function UsersPage() {
       title: t('common.actions'), key: 'actions', width: 120,
       render: (_, row) => (
         <Space size={4}>
-          <Tooltip title={t('users.setPassword')}>
+          <Tooltip title={isViewer ? t('auth.viewerBadge') : t('users.setPassword')}>
             <Button type="text" size="small" icon={<KeyOutlined />}
+              disabled={isViewer}
               onClick={() => { setPwTarget(row); pwForm.resetFields() }} />
           </Tooltip>
           <ActionButtons
@@ -159,13 +162,15 @@ export default function UsersPage() {
         dataSource={users ?? []}
         columns={columns}
         extraActions={
-          <Button type="primary" icon={<PlusOutlined />} onClick={() => {
-            setCreating(true)
-            createForm.resetFields()
-            createForm.setFieldsValue({ role: 'admin', active: true })
-          }}>
-            {t('users.addUser')}
-          </Button>
+          <Tooltip title={isViewer ? t('auth.viewerBadge') : undefined}>
+            <Button type="primary" icon={<PlusOutlined />} disabled={isViewer} onClick={() => {
+              setCreating(true)
+              createForm.resetFields()
+              createForm.setFieldsValue({ role: 'admin', active: true })
+            }}>
+              {t('users.addUser')}
+            </Button>
+          </Tooltip>
         }
         emptyContent={
           <EmptyState
@@ -173,13 +178,15 @@ export default function UsersPage() {
             title={t('users.emptyTitle')}
             description={t('users.emptyDesc')}
             action={
-              <Button type="primary" icon={<PlusOutlined />} onClick={() => {
-                setCreating(true)
-                createForm.resetFields()
-                createForm.setFieldsValue({ role: 'admin', active: true })
-              }}>
-                {t('users.addUser')}
-              </Button>
+              <Tooltip title={isViewer ? t('auth.viewerBadge') : undefined}>
+                <Button type="primary" icon={<PlusOutlined />} disabled={isViewer} onClick={() => {
+                  setCreating(true)
+                  createForm.resetFields()
+                  createForm.setFieldsValue({ role: 'admin', active: true })
+                }}>
+                  {t('users.addUser')}
+                </Button>
+              </Tooltip>
             }
           />
         }