Marc-André Bombeck 45ee70acb7 fix(settings): list record content only where the grant manages it ...

The anamnesis page writes through requireRecordAuth("manage",
"profile"), which refuses a grant whose sections do not reach profile.
The Settings list and the navigation entry checked only the level and
the record kind, so a MANAGE grant scoped away from profile would be
offered a page whose saves are refused.

Record-content destinations now name the section they write, and are
listed only when the active record's manageable sections include it.
A destination without a named section is never listed. The shell and
the navigation read the same predicate. MANAGE grants are whole-record
today, so managed profiles and adult MANAGE shares list what they did
before.

Refs #939

2026-09-13 14:49:56 +02:00

..

access.ts

feat: show managed integration status

2026-08-06 02:38:54 +02:00

classification.ts

fix(settings): list record content only where the grant manages it

2026-09-13 14:49:56 +02:00

configuration.ts

feat: gate a switched browser on the record's modules, not the actor's

2026-09-10 00:02:03 +02:00

dto.ts

feat: add record keyed settings

2026-08-06 02:26:44 +02:00

index.ts

perf(shell): import the settings-destination predicate from its leaf

2026-08-23 20:56:13 +02:00

integrations.ts

fix(settings): a fresh managed connection reads as connected again

2026-09-11 10:54:56 +02:00

modules.ts

refactor(modules): one record-keyed write for a record's module state

2026-09-10 11:54:19 +02:00

response.ts

feat: configure managed record settings

2026-08-06 03:21:02 +02:00