collavre 0.5.0 → 0.7.0

data/app/controllers/collavre/comments_controller.rb

@@ -1,5 +1,9 @@
 module Collavre
   class CommentsController < ApplicationController
+    include Collavre::Comments::ApprovalActions
+    include Collavre::Comments::Conversion
+    include Collavre::Comments::BatchOperations
+
     before_action :set_creative
     before_action :set_comment, only: [ :destroy, :show, :update, :convert, :approve, :update_action ]
 
@@ -11,6 +15,9 @@ module Collavre
       @creatives = []
       @shared_list = @creative.all_shared_users
       @auto_fullscreen = true
+      # Set params[:id] so the tree URL in creatives/index loads children of this
+      # creative instead of the root list.
+      params[:id] = @creative.id.to_s
       # Prepend creatives prefix so partials like 'add_button' resolve to collavre/creatives/_add_button
       lookup_context.prefixes.prepend "collavre/creatives"
       render "collavre/creatives/index"
@@ -25,7 +32,7 @@ module Collavre
         Current.user.id,
         Current.user.id
       )
-      scope = visible_scope.with_attached_images.includes(:topic, :comment_reactions)
+      scope = visible_scope.with_attached_images.includes(:topic, :comment_reactions, :comment_versions)
 
       if params[:search].present?
         search_term = ActiveRecord::Base.sanitize_sql_like(params[:search].to_s.strip.downcase)
@@ -191,7 +198,7 @@ module Collavre
             )
           end
         end
-        @comment = Comment.with_attached_images.includes(:comment_reactions).find(@comment.id)
+        @comment = Comment.with_attached_images.includes(:comment_reactions, :comment_versions, :selected_version).find(@comment.id)
         render partial: "collavre/comments/comment", locals: { comment: @comment, current_topic_id: current_topic_context }, status: :created
       else
         render json: { errors: @comment.errors.full_messages }, status: :unprocessable_entity
@@ -206,7 +213,7 @@ module Collavre
         end
 
         if @comment.update(safe_params)
-          @comment = Comment.with_attached_images.includes(:comment_reactions).find(@comment.id)
+          @comment = Comment.with_attached_images.includes(:comment_reactions, :comment_versions, :selected_version).find(@comment.id)
           render partial: "collavre/comments/comment", locals: { comment: @comment, current_topic_id: current_topic_context }
         else
           render json: { errors: @comment.errors.full_messages }, status: :unprocessable_entity
@@ -248,132 +255,7 @@ module Collavre
       end
     end
 
-    def convert
-      unless can_convert_comment?
-        render json: { error: I18n.t("collavre.comments.convert_not_allowed") }, status: :forbidden and return
-      end
-
-      created_creatives = ::MarkdownImporter.import(
-        @comment.content,
-        parent: @creative,
-        user: @creative.user,
-        create_root: true
-      )
-
-      primary_creative = created_creatives.first
-      system_message = build_convert_system_message(primary_creative) if primary_creative
-
-      @comment.destroy
-
-      if system_message.present?
-        Current.set(session: nil) do
-          @creative.comments.create!(content: system_message, user: nil)
-        end
-      end
-
-      head :no_content
-    end
-
-    def approve
-      status = @comment.approval_status(Current.user)
-      if status != :ok
-        error_key = case status
-        when :invalid_action_format then "collavre.comments.approve_invalid_format"
-        when :missing_action then "collavre.comments.approve_missing_action"
-        when :missing_approver then "collavre.comments.approve_missing_approver"
-        when :admin_required then "collavre.comments.approve_admin_required"
-        else "collavre.comments.approve_not_allowed"
-        end
-        http_status = case status
-        when :invalid_action_format, :missing_action, :missing_approver
-                        :unprocessable_entity
-        else
-                        :forbidden
-        end
-        render json: { error: I18n.t(error_key) }, status: http_status and return
-      end
-
-      begin
-        ::Comments::ActionExecutor.new(comment: @comment, executor: Current.user).call
-        @comment = Comment.with_attached_images.includes(:comment_reactions).find(@comment.id)
-        render partial: "collavre/comments/comment", locals: { comment: @comment, current_topic_id: current_topic_context }
-      rescue ::Comments::ActionExecutor::ExecutionError => e
-        render json: { error: e.message }, status: :unprocessable_entity
-      end
-    end
-
-    def update_action
-      # Initial checks outside the lock
-      executed_error = false
-      update_success = false
-      approver_mismatch_error = false
-      status_error_key = nil
-      status_http_status = nil
-      validation_error_message = nil
-
-      @comment.with_lock do
-        @comment.reload
-
-        status_in_lock = @comment.approval_status(Current.user)
-        # Allow repairing invalid format if user is approver
-        if status_in_lock == :invalid_action_format
-          if @comment.approver_id == Current.user&.id
-            status_in_lock = :ok
-          else
-            status_in_lock = :not_allowed
-          end
-        end
-
-        if status_in_lock != :ok
-          approver_mismatch_error = true
-          status_error_key = case status_in_lock
-          when :invalid_action_format then "collavre.comments.approve_invalid_format"
-          when :missing_action then "collavre.comments.approve_missing_action"
-          when :missing_approver then "collavre.comments.approve_missing_approver"
-          when :admin_required then "collavre.comments.approve_admin_required"
-          else "collavre.comments.approve_not_allowed"
-          end
-          status_http_status = case status_in_lock
-          when :invalid_action_format, :missing_action, :missing_approver
-                          :unprocessable_entity
-          else
-                          :forbidden
-          end
-        elsif @comment.action_executed_at.present?
-          executed_error = true
-        else
-          action_payload = params.dig(:comment, :action)
-          if action_payload.blank?
-            validation_error_message = I18n.t("collavre.comments.approve_missing_action")
-          else
-            begin
-              validator = ::Comments::ActionValidator.new(comment: @comment)
-              parsed_payload = validator.validate!(action_payload)
-              normalized_action = JSON.pretty_generate(parsed_payload)
-              update_success = @comment.update(action: normalized_action)
-            rescue ::Comments::ActionValidator::ValidationError => e
-              validation_error_message = e.message
-            end
-          end
-        end
-      end
 
-      if approver_mismatch_error
-        render json: { error: I18n.t(status_error_key) }, status: status_http_status
-      elsif validation_error_message
-        render json: { error: validation_error_message }, status: :unprocessable_entity
-      elsif executed_error
-        render json: { error: I18n.t("collavre.comments.approve_already_executed") }, status: :unprocessable_entity
-      elsif update_success
-        @comment = Comment.with_attached_images.includes(:comment_reactions).find(@comment.id)
-        render partial: "collavre/comments/comment", locals: { comment: @comment, current_topic_id: current_topic_context }
-      else
-        error_message = @comment.errors.full_messages.to_sentence.presence || I18n.t("collavre.comments.action_update_error")
-        render json: { error: error_message }, status: :unprocessable_entity
-      end
-    rescue ::Comments::ActionValidator::ValidationError => e
-      render json: { error: e.message }, status: :unprocessable_entity
-    end
 
     def show
       redirect_to creative_path(@creative, comment_id: @comment.id)
@@ -406,24 +288,14 @@ module Collavre
       render json: CommandMenuService.new(user: Current.user).items
     end
 
-    def move
-      result = CommentMoveService.new(creative: @creative, user: Current.user).call(
-        comment_ids: params[:comment_ids],
-        target_creative_id: params[:target_creative_id],
-        target_topic_id: params[:target_topic_id]
-      )
-      render json: result
-    rescue CommentMoveService::MoveError => e
-      status = e.message == I18n.t("collavre.comments.move_not_allowed") ? :forbidden : :unprocessable_entity
-      render json: { error: e.message }, status: status
-    rescue ActiveRecord::RecordInvalid => e
-      render json: { error: e.record.errors.full_messages.to_sentence.presence || I18n.t("collavre.comments.move_error") }, status: :unprocessable_entity
-    end
 
     private
 
     def set_creative
       @creative = Creative.find(params[:creative_id]).effective_origin
+      unless @creative.has_permission?(Current.user, :read)
+        render json: { error: I18n.t("collavre.creatives.errors.no_permission") }, status: :forbidden
+      end
     end
 
     def set_comment
@@ -438,18 +310,7 @@ module Collavre
     end
 
     def comment_params
-      params.require(:comment).permit(:content, :private, :topic_id, :quoted_comment_id, :quoted_text, images: [])
-    end
-
-    def can_convert_comment?
-      @comment.user == Current.user || @creative.has_permission?(Current.user, :admin)
-    end
-
-    def build_convert_system_message(creative)
-      title = helpers.strip_tags(creative.description).to_s.strip
-      title = I18n.t("collavre.comments.convert_system_message_default_title") if title.blank?
-      url = creative_path(creative)
-      I18n.t("collavre.comments.convert_system_message", title: title, url: url)
+      params.require(:comment).permit(:content, :private, :topic_id, :quoted_comment_id, :quoted_text, :review_type, images: [])
     end
 
     def current_topic_context

data/app/controllers/collavre/concerns/exportable.rb

@@ -0,0 +1,30 @@
+module Collavre
+  module Concerns
+    module Exportable
+      extend ActiveSupport::Concern
+
+      def export_markdown
+        creatives = if params[:parent_id]
+          parent_creative = Creative.find(params[:parent_id])
+          effective_origin = parent_creative.effective_origin
+          unless parent_creative.has_permission?(Current.user, :read) &&
+                 effective_origin.has_permission?(Current.user, :read)
+            render plain: t("collavre.creatives.errors.no_permission"), status: :forbidden and return
+          end
+          [ effective_origin ]
+        else
+          Creative.where(parent_id: nil).map(&:effective_origin).uniq.select do |creative|
+            creative.has_permission?(Current.user, :read)
+          end
+        end
+
+        if creatives.empty?
+          render plain: t("collavre.creatives.errors.no_permission"), status: :forbidden and return
+        end
+
+        markdown = helpers.render_creative_tree_markdown(creatives)
+        send_data markdown, filename: "creatives.md", type: "text/markdown"
+      end
+    end
+  end
+end

data/app/controllers/collavre/concerns/shareable.rb

@@ -0,0 +1,28 @@
+module Collavre
+  module Concerns
+    module Shareable
+      extend ActiveSupport::Concern
+
+      def request_permission
+        creative = @creative.effective_origin
+        if creative.user == Current.user || creative.has_permission?(Current.user, :read)
+          return head :unprocessable_entity
+        end
+
+        short_title = helpers.strip_tags(creative.effective_origin.description).truncate(10)
+
+        InboxItem.create!(
+          owner: creative.user,
+          message_key: "inbox.permission_requested",
+          message_params: { user: Current.user.display_name, short_title: short_title },
+          link: creative_url(
+            creative,
+            Rails.application.config.action_mailer.default_url_options.merge(share_request: Current.user.email)
+          )
+        )
+
+        head :ok
+      end
+    end
+  end
+end

data/app/controllers/collavre/concerns/slide_viewable.rb

@@ -0,0 +1,37 @@
+module Collavre
+  module Concerns
+    module SlideViewable
+      extend ActiveSupport::Concern
+
+      def slide_view
+        unless @creative.has_permission?(Current.user, :read)
+          if Current.user
+            redirect_to creatives_path, alert: t("collavre.creatives.errors.no_permission")
+          else
+            request_authentication
+          end
+          return
+        end
+
+        @slide_ids = []
+        @root_depth = @creative.ancestors.count
+        build_slide_ids(@creative)
+        render layout: "collavre/slide"
+      end
+
+      private
+
+      def build_slide_ids(node)
+        return unless node.has_permission?(Current.user, :read)
+
+        @slide_ids << node.id
+        children = node.children.order(:sequence)
+        if node.origin_id.present?
+          linked_children = node.linked_children
+          children = (children + linked_children).uniq.sort_by(&:sequence)
+        end
+        children.each { |child| build_slide_ids(child) }
+      end
+    end
+  end
+end

data/app/controllers/collavre/concerns/tree_manageable.rb

@@ -0,0 +1,141 @@
+module Collavre
+  module Concerns
+    module TreeManageable
+      extend ActiveSupport::Concern
+
+      def reorder
+        dragged_ids = Array(params[:dragged_ids]).map(&:presence).compact
+        target_id = params[:target_id]
+        direction = params[:direction]
+
+        if dragged_ids.any?
+          reorderer.reorder_multiple(
+            dragged_ids: dragged_ids,
+            target_id: target_id,
+            direction: direction
+          )
+        else
+          reorderer.reorder(
+            dragged_id: params[:dragged_id],
+            target_id: target_id,
+            direction: direction
+          )
+        end
+        head :ok
+      rescue ::Creatives::Reorderer::Error
+        head :unprocessable_entity
+      end
+
+      def link_drop
+        result = reorderer.link_drop(
+          dragged_id: params[:dragged_id],
+          target_id: params[:target_id],
+          direction: params[:direction]
+        )
+
+        new_creative = result.new_creative
+        level = new_creative.ancestors.count + 1
+        nodes = build_tree(
+          [ new_creative ],
+          params: params,
+          expanded_state_map: {},
+          level: level
+        )
+
+        render json: {
+          nodes: nodes,
+          creative_id: new_creative.id,
+          parent_id: result.parent&.id,
+          direction: result.direction
+        }
+      rescue ::Creatives::Reorderer::Error
+        head :unprocessable_entity
+      end
+
+      def append_as_parent
+        @parent_creative = Creative.find_by(id: params[:parent_id]).parent
+        redirect_to new_creative_path(parent_id: @parent_creative&.id, child_id: params[:parent_id], tags: params[:tags])
+      end
+
+      def append_below
+        target = Creative.find_by(id: params[:creative_id])
+        redirect_to new_creative_path(parent_id: target&.parent_id, after_id: target&.id, tags: params[:tags])
+      end
+
+      def children
+        parent = Creative.find(params[:id])
+        effective = parent.effective_origin
+        # user_id for expanded_state lookup - use owner's state for anonymous users
+        state_user_id = Current.user&.id || effective.user_id
+
+        # HTTP caching disabled for children endpoint:
+        # Response depends on child updates, permission changes (CreativeSharesCache),
+        # and CreativeExpandedState. Tracking all dependencies reliably is expensive
+        # (requires descendant_ids query). Stale 304 responses could leak data after
+        # permission revocation. Re-enable when a cheap version key mechanism exists.
+        # Use private + no-store to prevent any caching (proxy or browser).
+        response.headers["Cache-Control"] = "private, no-store"
+
+        has_filters = params[:tags].present? || params[:min_progress].present? || params[:max_progress].present?
+        if has_filters
+          result = ::Creatives::IndexQuery.new(user: Current.user, params: params.merge(id: params[:id])).call
+          render_children_json(parent, state_user_id, result.allowed_creative_ids, result.progress_map)
+        else
+          render_children_json(parent, state_user_id, nil, nil)
+        end
+      end
+
+      def unconvert
+        base_creative = @creative.effective_origin
+        parent = base_creative.parent
+        if parent.nil?
+          render json: { error: t("collavre.creatives.index.unconvert_no_parent") }, status: :unprocessable_entity and return
+        end
+
+        unless parent.has_permission?(Current.user, :feedback)
+          render json: { error: t("collavre.creatives.errors.no_permission") }, status: :forbidden and return
+        end
+
+        unless base_creative.has_permission?(Current.user, :admin)
+          render json: { error: t("collavre.creatives.errors.no_permission") }, status: :forbidden and return
+        end
+
+        markdown = helpers.render_creative_tree_markdown([ base_creative ])
+        comment = nil
+
+        ActiveRecord::Base.transaction do
+          comment = parent.effective_origin.comments.create!(content: markdown, user: Current.user)
+          base_creative.descendants.each(&:destroy!)
+          base_creative.destroy!
+        end
+
+        render json: { comment_id: comment.id }, status: :created
+      rescue ActiveRecord::RecordInvalid => e
+        render json: { error: e.record.errors.full_messages.to_sentence }, status: :unprocessable_entity
+      end
+
+      private
+
+      def render_children_json(parent, user_id, allowed_ids, progress_map)
+        expanded_state_map = CreativeExpandedState
+                                .where(user_id: user_id, creative_id: parent.id)
+                                .first&.expanded_status || {}
+        children = parent.children_with_permission(Current.user)
+
+        level = params[:level].to_i
+        json_level = level.zero? ? 1 : level
+        render json: {
+          creatives: build_tree(
+            children,
+            params: params,
+            expanded_state_map: expanded_state_map,
+            level: json_level,
+            select_mode: params[:select_mode] == "1",
+            allowed_creative_ids: allowed_ids,
+            progress_map: progress_map
+          )
+        }
+      end
+    end
+  end
+end

data/app/controllers/collavre/creative_imports_controller.rb

@@ -1,5 +1,7 @@
 module Collavre
   class CreativeImportsController < ApplicationController
+    # Allow unauthenticated access so we can return JSON 401 instead of HTML redirect
+    # for API/fetch callers (import_controller.js uses csrfFetch with Accept: application/json)
     allow_unauthenticated_access only: :create
 
     def create
@@ -8,6 +10,10 @@ module Collavre
       end
 
       parent = params[:parent_id].present? ? Creative.find_by(id: params[:parent_id]) : nil
+      if parent && !parent.has_permission?(Current.user, :write)
+        render json: { error: I18n.t("collavre.creatives.errors.no_permission") }, status: :forbidden and return
+      end
+
       created = ::Creatives::Importer.new(file: params[:markdown], user: Current.user, parent: parent).call
 
       if created.any?

data/app/controllers/collavre/creative_invitations_controller.rb

@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+module Collavre
+  class CreativeInvitationsController < ApplicationController
+    before_action :set_invitation
+    before_action :authorize_admin!
+
+    def update
+      if @invitation.update(permission: params[:permission])
+        respond_to do |format|
+          format.html { redirect_back fallback_location: main_app.root_path, notice: t("collavre.creatives.share.permission_updated") }
+          format.json { render json: { permission: @invitation.permission }, status: :ok }
+        end
+      else
+        respond_to do |format|
+          format.html { redirect_back fallback_location: main_app.root_path, alert: @invitation.errors.full_messages.to_sentence }
+          format.json { render json: { error: @invitation.errors.full_messages.to_sentence }, status: :unprocessable_entity }
+        end
+      end
+    end
+
+    def destroy
+      @invitation.destroy
+      respond_to do |format|
+        format.html { redirect_back fallback_location: main_app.root_path, notice: t("collavre.contacts.org_chart.invite_cancelled") }
+        format.json { head :no_content }
+      end
+    end
+
+    private
+
+    def set_invitation
+      @invitation = Invitation.find(params[:id])
+      @creative = @invitation.creative
+    end
+
+    def authorize_admin!
+      return if @creative.has_permission?(Current.user, :admin)
+
+      respond_to do |format|
+        format.html { redirect_back fallback_location: main_app.root_path, alert: t("collavre.creatives.errors.no_permission") }
+        format.json { render json: { error: t("collavre.creatives.errors.no_permission") }, status: :forbidden }
+      end
+    end
+  end
+end

data/app/controllers/collavre/creative_plans_controller.rb

@@ -51,7 +51,7 @@ module Collavre
     private
 
     def tagger
-      ::Creatives::PlanTagger.new(plan_id: params[:plan_id], creative_ids: parsed_creative_ids)
+      ::Creatives::PlanTagger.new(plan_id: params[:plan_id], creative_ids: parsed_creative_ids, user: Current.user)
     end
 
     def parsed_creative_ids

data/app/controllers/collavre/creative_shares_controller.rb

@@ -1,22 +1,52 @@
 module Collavre
   class CreativeSharesController < ApplicationController
+    def index
+      @creative = Creative.find(params[:creative_id])
+      unless @creative.has_permission?(Current.user, :admin)
+        head :forbidden and return
+      end
+
+      @shared_list = CreativeShare.where(creative: @creative)
+                                  .includes(user: [ avatar_attachment: :blob ])
+
+      @pending_invitations = Invitation.where(creative: @creative, accepted_at: nil)
+                                       .where("expires_at > ?", Time.current)
+                                       .order(created_at: :desc)
+
+      render partial: "collavre/creatives/share_modal", layout: false
+    end
+
     def create
       @creative = Creative.find(params[:creative_id]).effective_origin
 
+      unless @creative.has_permission?(Current.user, :admin)
+        respond_to do |format|
+          format.html { redirect_back fallback_location: creatives_path, alert: t("collavre.creatives.errors.no_permission") }
+          format.json { render json: { error: t("collavre.creatives.errors.no_permission") }, status: :forbidden }
+        end
+        return
+      end
+
       user = nil
       if params[:user_email].present?
         user = User.find_by(email: params[:user_email])
         unless user
           invitation = Invitation.create!(email: params[:user_email], inviter: Current.user, creative: @creative, permission: params[:permission])
           InvitationMailer.with(invitation: invitation).invite.deliver_later
-          flash[:notice] = t("collavre.invites.invite_sent")
-          redirect_back(fallback_location: creatives_path) and return
+          respond_to do |format|
+            format.html { redirect_back fallback_location: creatives_path, notice: t("collavre.invites.invite_sent") }
+            format.json { render json: { notice: t("collavre.invites.invite_sent") }, status: :created }
+          end
+          return
         end
 
         # Restrict sharing non-searchable AI agents to their owners only
         if user.ai_user? && !user.searchable? && user.created_by_id != Current.user.id
-          flash[:alert] = t("collavre.creatives.share.cannot_share_private_ai_agent")
-          redirect_back(fallback_location: creatives_path) and return
+          respond_to do |format|
+            format.html { redirect_back fallback_location: creatives_path, alert: t("collavre.creatives.share.cannot_share_private_ai_agent") }
+            format.json { render json: { error: t("collavre.creatives.share.cannot_share_private_ai_agent") }, status: :forbidden }
+          end
+          return
         end
       end
 
@@ -36,14 +66,18 @@ module Collavre
       Rails.logger.debug "### closest_parent_share = #{closest_parent_share.inspect}, is_param_no_access: #{is_param_no_access}"
       if closest_parent_share.present?
         if closest_parent_share.permission == :no_access.to_s
-          flash[:alert] = t("collavre.creatives.share.can_not_share_by_no_access_in_parent")
-          redirect_back(fallback_location: creatives_path) and return
+          respond_to do |format|
+            format.html { redirect_back fallback_location: creatives_path, alert: t("collavre.creatives.share.can_not_share_by_no_access_in_parent") }
+            format.json { render json: { error: t("collavre.creatives.share.can_not_share_by_no_access_in_parent") }, status: :unprocessable_entity }
+          end
+          return
         else
-          if is_param_no_access
-            # can set!
-          else
-            flash[:alert] = t("collavre.creatives.share.already_shared_in_parent")
-            redirect_back(fallback_location: creatives_path) and return
+          unless is_param_no_access
+            respond_to do |format|
+              format.html { redirect_back fallback_location: creatives_path, alert: t("collavre.creatives.share.already_shared_in_parent") }
+              format.json { render json: { error: t("collavre.creatives.share.already_shared_in_parent") }, status: :unprocessable_entity }
+            end
+            return
           end
         end
       end
@@ -57,15 +91,51 @@ module Collavre
           Contact.ensure(user: Current.user, contact_user: user)
           Contact.ensure(user: @creative.user, contact_user: user)
         end
-        flash[:notice] = t("collavre.creatives.share.shared")
+        respond_to do |format|
+          format.html { redirect_back fallback_location: creatives_path, notice: t("collavre.creatives.share.shared") }
+          format.json { render json: { notice: t("collavre.creatives.share.shared") }, status: :created }
+        end
       else
-        flash[:alert] = share.errors.full_messages.to_sentence
+        respond_to do |format|
+          format.html { redirect_back fallback_location: creatives_path, alert: share.errors.full_messages.to_sentence }
+          format.json { render json: { error: share.errors.full_messages.to_sentence }, status: :unprocessable_entity }
+        end
+      end
+    end
+
+    def update
+      @creative_share = CreativeShare.find(params[:id])
+      unless @creative_share.creative.has_permission?(Current.user, :admin)
+        respond_to do |format|
+          format.html { redirect_back fallback_location: main_app.root_path, alert: t("collavre.creatives.errors.no_permission") }
+          format.json { render json: { error: t("collavre.creatives.errors.no_permission") }, status: :forbidden }
+        end
+        return
+      end
+
+      if @creative_share.update(permission: params[:permission])
+        respond_to do |format|
+          format.html { redirect_back fallback_location: main_app.root_path, notice: t("collavre.creatives.share.permission_updated") }
+          format.json { render json: { permission: @creative_share.permission }, status: :ok }
+        end
+      else
+        respond_to do |format|
+          format.html { redirect_back fallback_location: main_app.root_path, alert: @creative_share.errors.full_messages.to_sentence }
+          format.json { render json: { error: @creative_share.errors.full_messages.to_sentence }, status: :unprocessable_entity }
+        end
       end
-      redirect_back(fallback_location: creatives_path)
     end
 
     def destroy
       @creative_share = CreativeShare.find(params[:id])
+      unless @creative_share.creative.has_permission?(Current.user, :admin)
+        respond_to do |format|
+          format.html { redirect_back fallback_location: main_app.root_path, alert: t("collavre.creatives.errors.no_permission") }
+          format.json { render json: { error: t("collavre.creatives.errors.no_permission") }, status: :forbidden }
+        end
+        return
+      end
+
       @creative_share.destroy
       # remove linked creative if it exists
       linked_creative = Creative.find_by(origin_id: @creative_share.creative_id, user_id: @creative_share.user_id)