feat: roles SPA foundations

web/src/views/SettingsView.vue

@@ -18,6 +18,7 @@ import type { RestartKind, UpdateStatus } from '@/composables/useUpdate'
 import { reloadPage } from '@/lib/reloadPage'
 import { displayVersion, isCheckDue } from '@/lib/updateFormat'
 import { useSessionStore } from '@/stores/session'
+import { usePermissionsStore } from '@/stores/permissions'
 import { useUpdateStore, type RestartOutcome, type RestartRequestResult } from '@/stores/update'
 
 const SKELETON_DELAY_MS = 150
@@ -50,6 +51,7 @@ const { getSettings } = useSettings()
 const toast = useLocalizedToast()
 const overlay = useLocalizedOverlay()
 const session = useSessionStore()
+const permissions = usePermissionsStore()
 const update = useUpdateStore()
 const retry = useRetryAfter()
 
@@ -57,7 +59,8 @@ const updatesCard = ref<InstanceType<typeof UpdatesCard> | null>(null)
 const loadState = ref<LoadState>('loading')
 const settings = ref<WorkspaceSettings | null>(null)
 const version = computed(() => settings.value?.version ?? '')
-const isOwner = computed(() => session.isOwner)
+const canApply = computed(() => update.canApply)
+const canManageSites = computed(() => permissions.can('settings.manage_sites'))
 const showSkeleton = ref(false)
 let skeletonTimer: ReturnType<typeof setTimeout> | null = null
 
@@ -115,7 +118,7 @@ const updatesStatus = computed(() => {
 	if (update.status) {
 		return update.status
 	}
-	return update.loadState === 'error' && update.isOwner ? neverCheckedStatus() : null
+	return update.loadState === 'error' && update.canApply ? neverCheckedStatus() : null
 })
 
 const updatesPhase = computed(() => (update.status ? update.phase : 'failed'))
@@ -324,7 +327,7 @@ watch(
 		}
 		autoCheckHandled = true
 		const jobActive = update.jobRunning || update.readyToInstall
-		if (update.isOwner && !jobActive && isCheckDue(update.status?.checked_at ?? null)) {
+		if (update.canApply && !jobActive && isCheckDue(update.status?.checked_at ?? null)) {
 			onCheck()
 		}
 	},
@@ -454,7 +457,7 @@ onBeforeUnmount(() => {
 				v-if="updatesStatus"
 				ref="updatesCard"
 				:status="updatesStatus"
-				:role="session.session?.role"
+				:can-apply="canApply"
 				:phase="updatesPhase"
 				:apply-phase="update.applyPhase"
 				:retry-label="retry.formatted.value"
@@ -466,12 +469,11 @@ onBeforeUnmount(() => {
 
 			<MediaLinksCard />
 
-			<PublishingLinksCard v-if="isOwner" />
+			<PublishingLinksCard v-if="canManageSites" />
 
 			<MediaCleanupCard />
 
 			<RetentionCard
-				v-if="isOwner"
 				:settings="settings"
 				:load-state="loadState"
 				:show-skeleton="showSkeleton"