diff --git a/src/components/__tests__/delegated-write-affordances.test.tsx b/src/components/__tests__/delegated-write-affordances.test.tsx
new file mode 100644
index 000000000..ae1f4e03d
--- /dev/null
+++ b/src/components/__tests__/delegated-write-affordances.test.tsx
@@ -0,0 +1,198 @@
+/**
+ * What a delegate is offered, rendered rather than described.
+ *
+ * v1.36.0 shipped sharing read-only and gated it only in the application
+ * chrome. Every feature surface still painted its add button, and a delegate
+ * who tapped one met a 403 from a server that was right to refuse. These
+ * render the real controls to markup and assert the paint, on the three
+ * capability states a session can be in.
+ *
+ * The suite is SSR-only (`@testing-library/react` is not a dependency here),
+ * which bounds what it can prove: it holds the RENDER, never the click. A
+ * control that is absent here cannot be tapped, and that is the whole property
+ * — but a control that is present here is not proven to work, and a submit
+ * path is not proven at all. That leg lives in `e2e/account-sharing.spec.ts`.
+ *
+ * Mutation checks, run:
+ * - `useRecordCapabilities` returning `canAdd: true` unconditionally → the
+ * read-only legs for the intake row and the card menu go red.
+ * - `DeleteButton` dropping its `canManage` bail → "no row delete inside
+ * somebody else's record" goes red.
+ */
+import { describe, expect, it, vi } from "vitest";
+import { renderToStaticMarkup } from "react-dom/server";
+
+import { I18nProvider } from "@/lib/i18n/context";
+import type { AccountAccess } from "@/lib/sharing/account-access-view";
+
+const OWNER = {
+ accountId: "acct-owner",
+ username: "owner",
+ displayName: "Margarethe",
+ access: "read" as const,
+ canWrite: false,
+};
+
+const OWN_RECORD: AccountAccess = {
+ accounts: [OWNER],
+ active: null,
+ canSwitch: true,
+};
+const READ_ONLY: AccountAccess = {
+ accounts: [OWNER],
+ active: OWNER,
+ canSwitch: true,
+};
+const WRITABLE: AccountAccess = {
+ accounts: [OWNER],
+ active: { ...OWNER, access: "write", canWrite: true },
+ canSwitch: true,
+};
+
+const mockAccessRef: { value: AccountAccess } = { value: OWN_RECORD };
+
+vi.mock("@/hooks/use-auth", () => ({
+ useAuth: () => ({
+ user: {
+ id: "delegate",
+ username: "delegate",
+ email: null,
+ role: "USER",
+ avatarUrl: null,
+ modules: {},
+ accountAccess: mockAccessRef.value,
+ },
+ isAuthenticated: true,
+ isLoading: false,
+ refetch: vi.fn(),
+ }),
+}));
+
+import { DeleteButton } from "@/components/data-list/delete-button";
+import { SelectionActionBar } from "@/components/data-list/selection-action-bar";
+import { MedicationCardMenu } from "@/components/medications/medication-card-menu";
+import { MedicationIntakeActions } from "@/components/medications/card-parts/medication-intake-actions";
+import { visibleCaptureKinds } from "@/components/layout/capture-picker";
+
+function render(access: AccountAccess, node: React.ReactNode): string {
+ mockAccessRef.value = access;
+ return renderToStaticMarkup(
+ {node},
+ );
+}
+
+describe("row delete", () => {
+ const node = (
+ {}} title="Delete?" description="Gone." />
+ );
+
+ it("renders in the caller's own record", () => {
+ expect(render(OWN_RECORD, node)).toContain(" {
+ // Not disabled. A greyed bin still claims the row is the delegate's to
+ // remove, and it is not — at either grant level, including for a row the
+ // delegate entered themselves.
+ expect(render(READ_ONLY, node)).toBe("");
+ expect(render(WRITABLE, node)).toBe("");
+ });
+});
+
+describe("bulk selection bar", () => {
+ const node = (
+ {}}
+ onConfirmDelete={() => {}}
+ isDeleting={false}
+ confirmTitle="Delete 3?"
+ confirmBody="Gone."
+ />
+ );
+
+ it("renders in the caller's own record", () => {
+ expect(render(OWN_RECORD, node)).toContain(
+ 'data-slot="selection-action-bar"',
+ );
+ });
+
+ it("is absent inside somebody else's record", () => {
+ expect(render(WRITABLE, node)).toBe("");
+ });
+});
+
+describe("marking a dose", () => {
+ const node = (
+ {}} />
+ );
+
+ it("is offered to a delegate who may write", () => {
+ // The verb the delegation was written for: somebody looking after a
+ // parent marks the morning dose taken.
+ expect(render(WRITABLE, node)).toContain(" {
+ expect(render(READ_ONLY, node)).toBe("");
+ });
+
+ it("is offered in the caller's own record", () => {
+ expect(render(OWN_RECORD, node)).toContain(" {
+ const node = (
+ {}}
+ onOpenHistory={() => {}}
+ onLogSideEffect={() => {}}
+ />
+ );
+
+ it("renders its trigger in the caller's own record", () => {
+ expect(render(OWN_RECORD, node)).toContain(" {
+ // One item survives for them — noting a side effect — so the menu stays.
+ expect(render(WRITABLE, node)).toContain(" {
+ // Every item in it is owner work, so the trigger goes with them rather
+ // than opening onto an empty sheet.
+ expect(render(READ_ONLY, node)).toBe("");
+ });
+});
+
+describe("the capture picker's kinds", () => {
+ const ALL = ["measurement", "medication", "mood", "water"] as const;
+
+ it("offers everything in the caller's own record", () => {
+ expect(
+ visibleCaptureKinds({ canAdd: true, canManage: true }, true, [...ALL]),
+ ).toEqual(["measurement", "medication", "mood", "water"]);
+ });
+
+ it("offers a delegate only what the delegation admits", () => {
+ // A reading and a dose are admitted verbs. A mood entry and a glass of
+ // water are not, and the server refuses them under a switch.
+ expect(
+ visibleCaptureKinds({ canAdd: true, canManage: false }, true, [...ALL]),
+ ).toEqual(["measurement", "medication"]);
+ });
+
+ it("offers a read-only delegate nothing", () => {
+ expect(
+ visibleCaptureKinds({ canAdd: false, canManage: false }, true, [...ALL]),
+ ).toEqual([]);
+ });
+
+ it("still honours the module gate for the owner", () => {
+ expect(
+ visibleCaptureKinds({ canAdd: true, canManage: true }, false, [...ALL]),
+ ).toEqual(["measurement", "medication", "mood"]);
+ });
+});
diff --git a/src/components/data-list/delete-button.tsx b/src/components/data-list/delete-button.tsx
index c963e0026..9dc7d96ea 100644
--- a/src/components/data-list/delete-button.tsx
+++ b/src/components/data-list/delete-button.tsx
@@ -15,6 +15,7 @@ import {
AlertDialogTrigger,
} from "@/components/ui/alert-dialog";
import { useTranslations } from "@/lib/i18n/context";
+import { useRecordCapabilities } from "@/hooks/use-record-capabilities";
/**
* Shared single-row delete button + confirm dialog for the data-
@@ -25,6 +26,15 @@ import { useTranslations } from "@/lib/i18n/context";
* so the title/description are passed in rather than reaching for a fixed
* translation key. `cancelLabel` / `confirmLabel` default to the shared
* `common.*` strings.
+ *
+ * v1.36.x — this is the one place a row delete is spelled across the app
+ * (measurements, lab results, biomarkers, allergies, family history, custom
+ * metrics, medication inventory), so the delegation rule is enforced here
+ * rather than at twelve call sites: deleting is the owner's alone, at every
+ * grant level, so inside somebody else's record the trigger is absent. Not
+ * disabled — a greyed bin still claims the row is the delegate's to remove.
+ * A caller that ever needs a delete a delegate MAY perform would have to say
+ * so explicitly, and today there is none.
*/
export function DeleteButton({
onConfirm,
@@ -47,6 +57,8 @@ export function DeleteButton({
iconClassName?: string;
}) {
const { t } = useTranslations();
+ const { canManage } = useRecordCapabilities();
+ if (!canManage) return null;
return (
diff --git a/src/components/data-list/selection-action-bar.tsx b/src/components/data-list/selection-action-bar.tsx
index 027c1e9d9..866bc722d 100644
--- a/src/components/data-list/selection-action-bar.tsx
+++ b/src/components/data-list/selection-action-bar.tsx
@@ -15,6 +15,7 @@ import {
AlertDialogTrigger,
} from "@/components/ui/alert-dialog";
import { useTranslations } from "@/lib/i18n/context";
+import { useRecordCapabilities } from "@/hooks/use-record-capabilities";
/**
* Selection action bar for the data-management lists (measurements +
@@ -29,6 +30,11 @@ import { useTranslations } from "@/lib/i18n/context";
*
* The confirm copy is passed in because the title/body differ per surface
* (measurements vs mood) and the count is interpolated by the caller.
+ *
+ * v1.36.x — bulk delete is the owner's alone at every grant level, so the bar
+ * is absent inside somebody else's record. The row checkboxes that feed it are
+ * dropped at their lists for the same reason; this guard is the backstop, so a
+ * list that forgets cannot leave a delete button floating over the page.
*/
export function SelectionActionBar({
count,
@@ -46,8 +52,9 @@ export function SelectionActionBar({
confirmBody: string;
}) {
const { t } = useTranslations();
+ const { canManage } = useRecordCapabilities();
- if (count <= 0) return null;
+ if (count <= 0 || !canManage) return null;
return (