View-only shared folder: empty state still offers "Upload file" and "New folder" (server refuses: "Create failed: read-only access") #679

New issue

Closed

opened 2026-09-23 03:24:30 +00:00 by Cordy · 0 comments

Cordy commented

2026-09-23 03:24:30 +00:00

Owner

Found by the #656 QA pass (v0.6.247, files-bao, two users). This was the sharer1 permission-boundary probe.

Matrix row: §4 Sharing — "Group share | Share to a group | Members see it under Shares" (PASS) and "Recipient view | … opens read-only/edit per role".

Steps

As nikola-test, share _qa/drop/ (empty) with app group qa656 (member: sharer1), Can view.
As sharer1: Shares → Shared with me. The row reads "drop · nikola-test · Can view via qa656" (PASS). Open it → #/shared/nikola-test/drop, which shows a "View only" marker (PASS).
The toolbar controls are correctly disabled: New disabled, and the Upload file label at opacity 0.45 with pointer-events: none.
The empty state in the same view still says "Empty. Upload a file or create a folder to begin." Its Upload file (opacity 1, clickable) and New folder (enabled) buttons are live.
New folder → name dialog → OK → Create failed: read-only access.

Expected: in a view-only folder the empty state offers no write actions. It should read something like "This folder is empty. You have view access." (the style guide's honest-empty-state rule).
Seen: write CTAs that are guaranteed to fail. The server enforcement itself is correct, so the permission boundary holds.

Screenshot: none saved. The sharer1 session runs in the in-app browser, which cannot write screenshots. The state is quoted verbatim above.

Found by the #656 QA pass (v0.6.247, files-bao, two users). This was the sharer1 permission-boundary probe. **Matrix row:** §4 Sharing — "Group share | Share to a group | Members see it under Shares" (PASS) and "Recipient view | … opens read-only/edit per role". **Steps** 1. As nikola-test, share `_qa/drop/` (empty) with app group `qa656` (member: sharer1), Can view. 2. As sharer1: Shares → Shared with me. The row reads "drop · nikola-test · Can view via qa656" (PASS). Open it → `#/shared/nikola-test/drop`, which shows a "View only" marker (PASS). 3. The **toolbar** controls are correctly disabled: New `disabled`, and the Upload file label at opacity 0.45 with `pointer-events: none`. 4. The **empty state** in the same view still says "Empty. Upload a file or create a folder to begin." Its **Upload file** (opacity 1, clickable) and **New folder** (enabled) buttons are live. 5. New folder → name dialog → OK → `Create failed: read-only access`. **Expected:** in a view-only folder the empty state offers no write actions. It should read something like "This folder is empty. You have view access." (the style guide's honest-empty-state rule). **Seen:** write CTAs that are guaranteed to fail. The server enforcement itself is correct, so the permission boundary holds. **Screenshot:** none saved. The sharer1 session runs in the in-app browser, which cannot write screenshots. The state is quoted verbatim above.