From 7ed4884986cb6216e76ac170bc28586009941cac Mon Sep 17 00:00:00 2001
From: Jason Zimdars <jz@37signals.com>
Date: Fri, 7 Nov 2025 16:01:50 -0600
Subject: [PATCH] Disable most account and board settings for non-admins

---
 app/views/account/join_codes/show.html.erb   | 17 +++++++++++------
 app/views/account/settings/_entropy.html.erb |  2 +-
 app/views/account/settings/show.html.erb     |  7 ++++++-
 app/views/boards/edit.html.erb               | 11 ++++++++---
 app/views/boards/edit/_auto_close.html.erb   |  2 +-
 app/views/boards/edit/_name.html.erb         |  3 ++-
 app/views/boards/edit/_publication.html.erb  |  7 ++++---
 app/views/entropy/_auto_close.html.erb       |  4 +++-
 app/views/entropy/_knob.html.erb             |  6 ++++--
 9 files changed, 40 insertions(+), 19 deletions(-)

diff --git a/app/views/account/join_codes/show.html.erb b/app/views/account/join_codes/show.html.erb
index f3142b091..a1efbcc5a 100644
--- a/app/views/account/join_codes/show.html.erb
+++ b/app/views/account/join_codes/show.html.erb
@@ -17,10 +17,13 @@
   <% url = join_url(code: @join_code.code, tenant: @join_code.tenant, script_name: nil) %>
   <div class="flex align-center gap-half">
     <input type="text" class="input flex-item-grow" value="<%= url %>" readonly>
-    <%= button_to account_join_code_path, method: :delete, class: "btn btn--circle txt-small", data: {
-          turbo_confirm: "Are you sure you want to generate a new link? The previous code will stop working." } do %>
-      <%= icon_tag "refresh" %>
-      <span class="for-screen-reader">Generate a new code</span>
+
+    <% if Current.user.can_administer? %>
+      <%= button_to account_join_code_path, method: :delete, class: "btn btn--circle txt-small", data: {
+            turbo_confirm: "Are you sure you want to generate a new link? The previous code will stop working." } do %>
+        <%= icon_tag "refresh" %>
+        <span class="for-screen-reader">Generate a new code</span>
+      <% end %>
     <% end %>
   </div>
 
@@ -59,8 +62,10 @@
       This code has been used <%= @join_code.usage_count %>/<%= @join_code.usage_limit %> times
       (<%= @join_code.active? ? @join_code.usage_limit - @join_code.usage_count : "none" %> remaining)
 
-      <%= link_to edit_account_join_code_path, class: @join_code.active? ? "txt-link" : "txt-negative txt-underline" do %>
-        <span>Change limit</span>
+      <% if Current.user.can_administer? %>
+        <%= link_to edit_account_join_code_path, class: @join_code.active? ? "txt-link" : "txt-negative txt-underline" do %>
+          <span>Change limit</span>
+        <% end %>
       <% end %>
     </p>
   </footer>
diff --git a/app/views/account/settings/_entropy.html.erb b/app/views/account/settings/_entropy.html.erb
index f6056ab37..034d8128f 100644
--- a/app/views/account/settings/_entropy.html.erb
+++ b/app/views/account/settings/_entropy.html.erb
@@ -4,5 +4,5 @@
     <p class="margin-none-block-start">Fizzy doesn’t let stale cards stick around forever. Cards automatically close as “Not Now” without activity for specific period of time. <em>This is the default, global setting — you can override it on each board.</em></p>
   </header>
 
-  <%= render "entropy/auto_close", model: account.entropy, url: account_entropy_path %>
+  <%= render "entropy/auto_close", model: account.entropy, url: account_entropy_path, disabled: !Current.user.can_administer? %>
 </div>
diff --git a/app/views/account/settings/show.html.erb b/app/views/account/settings/show.html.erb
index 7e2dbbfbf..9df7b9889 100644
--- a/app/views/account/settings/show.html.erb
+++ b/app/views/account/settings/show.html.erb
@@ -1,7 +1,12 @@
 <% @page_title = "Account Settings" %>
 
 <% content_for :header do %>
-  <h1 class="header__title"><%= @page_title %></h1>
+  <h1 class="header__title">
+    <%= @page_title %>
+    <% unless Current.user.can_administer?%>
+      <div class="txt-normal font-weight-normal">Only admins can change these settings</div>
+    <% end %>
+  </h1>
 <% end %>
 
 <section class="settings margin-block-start-half">
diff --git a/app/views/boards/edit.html.erb b/app/views/boards/edit.html.erb
index 130456341..7428e0bb9 100644
--- a/app/views/boards/edit.html.erb
+++ b/app/views/boards/edit.html.erb
@@ -10,7 +10,12 @@
     <% end %>
   </div>
 
-  <h1 class="header__title"><%= @page_title %></h1>
+  <h1 class="header__title">
+    <div><%= @page_title %></div>
+    <% unless Current.user.can_administer_board?(@board) %>
+      <div class="txt-normal font-weight-normal">Only admins can change these settings</div>
+    <% end %>
+  </h1>
 <% end %>
 
 <section class="settings">
@@ -19,10 +24,10 @@
           controller: "form boards-form",
           boards_form_self_removal_prompt_message_value: "Are you sure you want to remove yourself from this board? You won’t be able to get back in unless someone invites you.",
           action: "turbo:submit-start->boards-form#submitWithWarning" } do |form| %>
-      <%= render "boards/edit/name", form: form %>
+      <%= render "boards/edit/name", form: form, board: @board %>
       <%= render "boards/edit/users", board: @board, selected_users: @selected_users, unselected_users: @unselected_users, form: form %>
 
-      <button type="submit" id="log_in" class="btn btn--link center txt-normal">
+      <button type="submit" id="log_in" class="btn btn--link center txt-normal" <%= "disabled" unless Current.user.can_administer_board?(@board) %>>
         <span>Save changes</span>
       </button>
 
diff --git a/app/views/boards/edit/_auto_close.html.erb b/app/views/boards/edit/_auto_close.html.erb
index d903ddacd..2e4dc55a2 100644
--- a/app/views/boards/edit/_auto_close.html.erb
+++ b/app/views/boards/edit/_auto_close.html.erb
@@ -2,6 +2,6 @@
   <div class="margin-block-end">
     <h2 class="divider txt-large">Auto close</h2>
     <p class="margin-none-block-start">Fizzy doesn’t let stale cards stick around forever. Cards automatically close as “Not now” if no one updates, comments, or moves a card for…</p>
-    <%= render "entropy/auto_close", model: board, url: board_entropy_path(board) %>
+    <%= render "entropy/auto_close", model: board, url: board_entropy_path(board), disabled: !Current.user.can_administer_board?(@board) %>
   </div>
 <% end %>
diff --git a/app/views/boards/edit/_name.html.erb b/app/views/boards/edit/_name.html.erb
index e238a838e..e1578a944 100644
--- a/app/views/boards/edit/_name.html.erb
+++ b/app/views/boards/edit/_name.html.erb
@@ -2,6 +2,7 @@
   <label class="flex-item-grow">
     <strong><%= form.text_field :name, name: "board[name]", class: "input full-width txt-medium",
           required: true, autofocus: false, placeholder: "Board name…",
-          data: { action: "keydown.enter->form#submit:prevent, keydown.esc->form#cancel" } %></strong>
+          data: { action: "keydown.enter->form#submit:prevent, keydown.esc->form#cancel" },
+          readonly: !Current.user.can_administer_board?(board) %></strong>
   </label>
 </div>
diff --git a/app/views/boards/edit/_publication.html.erb b/app/views/boards/edit/_publication.html.erb
index 68902e19e..8ff98d87e 100644
--- a/app/views/boards/edit/_publication.html.erb
+++ b/app/views/boards/edit/_publication.html.erb
@@ -10,7 +10,7 @@
         <span class="txt-large"><%= icon_tag "lock" %></span>
         <label class="switch flex align-center justify-between">
           <%= form_with url: board_publication_path(board), method: :delete, data: { controller: "form" } do |form| %>
-            <%= form.check_box :published, class: "switch__input", checked: true, data: { action: "change->form#submit" } %>
+            <%= form.check_box :published, class: "switch__input", checked: true, data: { action: "change->form#submit" }, disabled: !Current.user.can_administer_board?(@board) %>
             <span class="switch__btn round"></span>
             <span class="for-screen-reader">Turn off the public link</span>
           <% end %>
@@ -32,7 +32,8 @@
         <%= form_with model: board, class: "txt-align-start", data: { controller: "form", turbo_frame: "_top" } do |form| %>
           <%= form.rich_textarea :public_description, class: "rich-text-content txt-small",
             placeholder: "Add a public note about this board…",
-            data: { action: "keydown.ctrl+enter->form#submit:prevent keydown.meta+enter->form#submit:prevent keydown.esc->form#cancel:stop" } %>
+            data: { action: "keydown.ctrl+enter->form#submit:prevent keydown.meta+enter->form#submit:prevent keydown.esc->form#cancel:stop" },
+            readonly: !Current.user.can_administer_board?(@board) %>
           <%= form.button "Save changes", type: :submit, class: "btn txt-small" %>
         <% end %>
       </div>
@@ -43,7 +44,7 @@
         <span class="txt-large"><%= icon_tag "lock" %></span>
         <label class="switch flex align-center justify-between">
           <%= form_with url: board_publication_path(board), method: :post, data: { controller: "form" } do |form| %>
-            <%= form.check_box :published, class: "switch__input", checked: false, data: { action: "change->form#submit" } %>
+            <%= form.check_box :published, class: "switch__input", checked: false, data: { action: "change->form#submit" }, disabled: !Current.user.can_administer_board?(@board) %>
             <span class="switch__btn round"></span>
             <span class="for-screen-reader">Turn on the public link</span>
           <% end %>
diff --git a/app/views/entropy/_auto_close.html.erb b/app/views/entropy/_auto_close.html.erb
index 73655d0f6..6ccb5d205 100644
--- a/app/views/entropy/_auto_close.html.erb
+++ b/app/views/entropy/_auto_close.html.erb
@@ -1,4 +1,5 @@
 <% url = local_assigns[:url] %>
+<% disabled = local_assigns[:disabled] %>
 
 <div class="flex align-start gap txt-align-center">
   <div class="flex flex-column flex-1">
@@ -7,7 +8,8 @@
             form: form,
             name: :auto_postpone_period,
             knob_options: entropy_auto_close_options,
-            label: "Days until auto-close" %>
+            label: "Days until auto-close",
+            disabled: disabled  %>
     <% end %>
   </div>
 </div>
diff --git a/app/views/entropy/_knob.html.erb b/app/views/entropy/_knob.html.erb
index bfe92ed71..69bbb5fb0 100644
--- a/app/views/entropy/_knob.html.erb
+++ b/app/views/entropy/_knob.html.erb
@@ -13,7 +13,8 @@
                 action: "change->knob#optionChanged change->form#submit",
                 index: index,
                 knob_target: "option"
-              } %>
+              },
+              disabled: disabled %>
         <span><%= value %></span>
       </label>
     <% end %>
@@ -23,7 +24,8 @@
           data: { action: "input->knob#sliderChanged change->form#submit", knob_target: "slider" },
           "aria-hidden": true,
           max: knob_options.length - 1,
-          min: 0
+          min: 0,
+          disabled: disabled
     %>
 
     <div class="knob__knob" aria-hidden></div>