@byline/admin 4.19.0 → 5.1.0

package/dist/modules/auth/sign-in-rate-limiter.js

@@ -0,0 +1,229 @@
+import { createHmac } from "node:crypto";
+import { isIP } from "node:net";
+const DEFAULT_POLICY = {
+    account: {
+        limit: 10,
+        windowSeconds: 900
+    },
+    ip: {
+        limit: 60,
+        windowSeconds: 60
+    }
+};
+const CLEANUP_TASK_NAME = 'auth.sign-in-counters.cleanup';
+function signInNetwork(ip) {
+    const version = isIP(ip);
+    if (4 === version) return ip;
+    if (6 !== version || ip.includes('%')) throw new Error('Invalid client address');
+    const canonical = new URL(`http://[${ip}]/`).hostname.slice(1, -1);
+    const mapped = /^::ffff:([0-9a-f]+):([0-9a-f]+)$/.exec(canonical);
+    if (mapped) {
+        const high = Number.parseInt(mapped[1], 16);
+        const low = Number.parseInt(mapped[2], 16);
+        return [
+            high >>> 8,
+            255 & high,
+            low >>> 8,
+            255 & low
+        ].join('.');
+    }
+    const [left, right] = canonical.split('::');
+    const head = left ? left.split(':') : [];
+    const tail = right ? right.split(':') : [];
+    const words = void 0 === right ? head : [
+        ...head,
+        ...Array(8 - head.length - tail.length).fill('0'),
+        ...tail
+    ];
+    return `${words.slice(0, 4).join(':')}::/64`;
+}
+function createPasswordSignInLimiter(store, secret, policy = DEFAULT_POLICY, now = Date.now, options = {}) {
+    const secretBytes = 'string' == typeof secret ? new TextEncoder().encode(secret) : secret;
+    if (secretBytes.byteLength < 32) throw new Error('Sign-in HMAC secret must contain at least 32 bytes');
+    const key = createHmac('sha256', secretBytes).update('byline:password-sign-in:v1').digest();
+    const digest = (value)=>createHmac('sha256', key).update(JSON.stringify(value)).digest('hex');
+    const rules = structuredClone(policy);
+    for (const rule of Object.values(rules))if (!Number.isSafeInteger(rule.limit) || rule.limit < 1 || rule.limit > 1000000 || !Number.isSafeInteger(rule.windowSeconds) || rule.windowSeconds < 1 || rule.windowSeconds > 86400) throw new Error('Invalid password sign-in rate limit policy');
+    const slots = options.slots ?? 1;
+    const maxQueue = options.maxQueue ?? 4;
+    const queueTimeoutMs = options.queueTimeoutMs ?? 250;
+    const minimumSlotMs = options.minimumSlotMs ?? 100;
+    for (const value of [
+        slots,
+        queueTimeoutMs,
+        minimumSlotMs
+    ])if (!Number.isSafeInteger(value) || value < 1 || value > 60000) throw new Error('Invalid sign-in capacity policy');
+    if (!Number.isSafeInteger(maxQueue) || maxQueue < 0 || maxQueue > 1000) throw new Error('Invalid sign-in queue size');
+    const diagnostics = new Map();
+    const emit = (event)=>{
+        try {
+            if (options.onEvent) options.onEvent(event);
+            else if ('admitted' !== event.type && 'success' !== event.type) {
+                const entry = diagnostics.get(event.type) ?? {
+                    last: -1 / 0,
+                    count: 0
+                };
+                entry.count++;
+                if (performance.now() - entry.last >= 10000) {
+                    console.warn('[byline:password-sign-in]', {
+                        ...event,
+                        count: entry.count
+                    });
+                    entry.last = performance.now();
+                    entry.count = 0;
+                }
+                diagnostics.set(event.type, entry);
+            }
+        } catch  {}
+    };
+    const identifiers = ({ email, ip })=>({
+            account: digest([
+                'account',
+                email.trim().toLowerCase()
+            ]),
+            network: digest([
+                'network',
+                signInNetwork(ip)
+            ])
+        });
+    let active = 0;
+    let disposed = false;
+    const queue = [];
+    const lease = ()=>{
+        active++;
+        const started = performance.now();
+        let released = false;
+        return ()=>{
+            if (released) return;
+            released = true;
+            setTimeout(()=>{
+                active--;
+                queue.shift()?.grant();
+            }, Math.max(0, minimumSlotMs - (performance.now() - started))).unref();
+        };
+    };
+    const cleanupTask = {
+        name: CLEANUP_TASK_NAME,
+        intervalMs: 60000,
+        leaseMs: 60000,
+        async run (context) {
+            const cutoff = new Date(now() - 300000);
+            try {
+                for(let batch = 0; batch < 32; batch++){
+                    context.signal.throwIfAborted();
+                    await context.heartbeat();
+                    if (await store.purgeExpired(cutoff) < 100) return {
+                        workRemaining: false
+                    };
+                }
+                return {
+                    workRemaining: true
+                };
+            } catch (error) {
+                emit({
+                    type: 'cleanup-error'
+                });
+                throw error;
+            }
+        }
+    };
+    return {
+        requiredCleanupTask: CLEANUP_TASK_NAME,
+        cleanupTask,
+        dispose () {
+            disposed = true;
+            for (const waiter of queue.splice(0))waiter.cancel();
+        },
+        async acquire () {
+            if (disposed) throw new Error('Sign-in limiter disposed');
+            if (active < slots) return lease();
+            if (queue.length >= maxQueue) {
+                emit({
+                    type: 'capacity'
+                });
+                return null;
+            }
+            return new Promise((resolve)=>{
+                const waiter = {
+                    grant: ()=>{
+                        clearTimeout(timeout);
+                        resolve(lease());
+                    },
+                    cancel: ()=>{
+                        clearTimeout(timeout);
+                        emit({
+                            type: 'capacity'
+                        });
+                        resolve(null);
+                    }
+                };
+                const timeout = setTimeout(()=>{
+                    queue.splice(queue.indexOf(waiter), 1);
+                    waiter.cancel();
+                }, queueTimeoutMs);
+                queue.push(waiter);
+            });
+        },
+        recordResult (input, outcome) {
+            emit({
+                type: outcome,
+                ...identifiers(input)
+            });
+        },
+        async consume (input) {
+            const time = now();
+            const network = signInNetwork(input.ip);
+            const ids = identifiers(input);
+            try {
+                await store.purgeExpired(new Date(time - 300000));
+                for (const [scope, identity] of [
+                    [
+                        'ip',
+                        network
+                    ],
+                    [
+                        'account',
+                        [
+                            input.email.trim().toLowerCase(),
+                            network
+                        ]
+                    ]
+                ]){
+                    const rule = rules[scope];
+                    const windowMs = 1000 * rule.windowSeconds;
+                    const end = (Math.floor(time / windowMs) + 1) * windowMs;
+                    if (!await store.consume(digest([
+                        scope,
+                        identity,
+                        end
+                    ]), rule.limit, new Date(end))) {
+                        emit({
+                            type: 'denied',
+                            scope,
+                            ...ids
+                        });
+                        return {
+                            allowed: false,
+                            retryAfterSeconds: Math.max(1, Math.ceil((end - time) / 1000))
+                        };
+                    }
+                }
+                emit({
+                    type: 'admitted',
+                    ...ids
+                });
+                return {
+                    allowed: true,
+                    retryAfterSeconds: 0
+                };
+            } catch (error) {
+                emit({
+                    type: 'store-error',
+                    ...ids
+                });
+                throw error;
+            }
+        }
+    };
+}
+export { createPasswordSignInLimiter };

package/dist/store.d.ts

@@ -8,8 +8,10 @@
 import type { AdminPermissionsRepository } from './modules/admin-permissions/repository.js';
 import type { AdminPreferencesRepository } from './modules/admin-preferences/repository.js';
 import type { AdminRolesRepository } from './modules/admin-roles/repository.js';
-import type { AdminUsersRepository } from './modules/admin-users/repository.js';
+import type { AdminUsersRepository, AdminUserWithPasswordRow } from './modules/admin-users/repository.js';
+import type { LoginSessionsRepository } from './modules/auth/login-sessions-repository.js';
 import type { RefreshTokensRepository } from './modules/auth/refresh-tokens-repository.js';
+import type { SignInRateLimitStore } from './modules/auth/sign-in-rate-limiter.js';
 /**
  * The bundle of repositories that `@byline/admin` needs from the DB
  * adapter. A DB adapter package (`@byline/db-postgres`, a future
@@ -19,11 +21,22 @@ import type { RefreshTokensRepository } from './modules/auth/refresh-tokens-repo
  * `JwtSessionProvider`, to `seedSuperAdmin`, and (later) to admin-user
  * and admin-role commands.
  *
- * Keeping the five repositories together as a single argument avoids
+ * Keeping the repositories together as a single argument avoids
  * exploding constructor signatures and makes "needs admin DB access" a
  * single, recognisable type.
  */
 export interface AdminStore {
+    /**
+     * Serialize native issuance/revocation against account mutations. Lock the
+     * account row first, then operate on refresh rows through the scoped store.
+     * The callback and all its writes commit together or roll back together.
+     * Never retain the scoped repositories beyond the callback. No automatic retries.
+     */
+    withSessionLock<T>(adminUserId: string, work: (store: AdminStore, user: AdminUserWithPasswordRow | null) => Promise<T>): Promise<T>;
+    /** Lock distinct account IDs in sorted order in one transaction for account-switch sign-in. */
+    withSessionLocks<T>(adminUserIds: string[], work: (store: AdminStore) => Promise<T>): Promise<T>;
+    loginSessions: LoginSessionsRepository;
+    signInRateLimits: SignInRateLimitStore;
     adminUsers: AdminUsersRepository;
     adminRoles: AdminRolesRepository;
     adminPermissions: AdminPermissionsRepository;

package/package.json

@@ -2,7 +2,7 @@
   "name": "@byline/admin",
   "private": false,
   "license": "MPL-2.0",
-  "version": "4.19.0",
+  "version": "5.1.0",
   "engines": {
     "node": ">=20.9.0"
   },
@@ -174,40 +174,40 @@
     "@codemirror/lang-sql": "^6.10.0",
     "@codemirror/lang-yaml": "^6.1.3",
     "@codemirror/language": "^6.12.4",
-    "@codemirror/state": "^6.7.1",
-    "@codemirror/view": "^6.43.9",
+    "@codemirror/state": "^6.7.4",
+    "@codemirror/view": "^6.43.11",
     "@lezer/highlight": "^1.2.3",
     "@tanstack/react-form-start": "^1.33.5",
     "clsx": "^2.1.1",
-    "jose": "^6.2.10",
+    "jose": "^6.2.12",
     "react-diff-viewer-continued": "^4.4.0",
     "uuid": "^14.0.2",
-    "zod": "^4.4.3",
-    "@byline/analytics": "4.19.0",
-    "@byline/analytics-agent": "4.19.0",
-    "@byline/auth": "4.19.0",
-    "@byline/ui": "4.19.0",
-    "@byline/i18n": "4.19.0",
-    "@byline/core": "4.19.0"
+    "zod": "^4.5.4",
+    "@byline/analytics": "5.1.0",
+    "@byline/analytics-agent": "5.1.0",
+    "@byline/core": "5.1.0",
+    "@byline/auth": "5.1.0",
+    "@byline/ui": "5.1.0",
+    "@byline/i18n": "5.1.0"
   },
   "peerDependencies": {
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
   },
   "devDependencies": {
-    "@biomejs/biome": "2.5.10",
+    "@biomejs/biome": "2.5.12",
     "@rsbuild/plugin-react": "^2.1.0",
-    "@rslib/core": "^0.23.2",
-    "@types/node": "^26.4.0",
+    "@rslib/core": "^1.0.0",
+    "@types/node": "^26.5.0",
     "@types/react": "19.2.18",
-    "@types/react-dom": "19.2.5",
-    "@vitejs/plugin-react": "^6.1.0",
+    "@types/react-dom": "19.2.7",
+    "@vitejs/plugin-react": "^6.1.1",
     "jsdom": "^30.0.1",
     "react": "^19.2.8",
     "react-dom": "^19.2.8",
     "typescript": "^7.0.2",
     "typescript-plugin-css-modules": "^5.2.0",
-    "vitest": "^4.1.11"
+    "vitest": "^5.0.0"
   },
   "publishConfig": {
     "access": "public",

package/src/fields/field-services-types.ts

@@ -1,3 +1,4 @@
+import type { StructuralMutationReceipt } from '@byline/core'
 /**
  * This Source Code is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -72,6 +73,7 @@ export interface TreeAncestor {
 }
 
 export interface PlaceTreeNodeInput {
+  expectedRevision: number
   collection: string
   documentId: string
   /** The new parent; `null` makes the document a root node. */
@@ -82,10 +84,16 @@ export interface PlaceTreeNodeInput {
 }
 
 /** Place / move a document within its collection's tree. */
-export type PlaceTreeNodeFn = (input: PlaceTreeNodeInput) => Promise<{ orderKey: string }>
+export type PlaceTreeNodeFn = (
+  input: PlaceTreeNodeInput
+) => Promise<{ orderKey: string } & StructuralMutationReceipt>
 
 /** Remove a document from the tree (back to the unplaced state). */
-export type RemoveFromTreeFn = (input: { collection: string; documentId: string }) => Promise<void>
+export type RemoveFromTreeFn = (input: {
+  collection: string
+  documentId: string
+  expectedRevision: number
+}) => Promise<StructuralMutationReceipt>
 
 /** Resolve a document's ancestor chain, root-first, hydrated with titles. */
 export type GetTreeAncestorsFn = (input: {

package/src/forms/available-locales-widget.tsx

@@ -27,6 +27,7 @@ export interface AvailableLocalesWidgetLocale {
 }
 
 export interface AvailableLocalesWidgetProps {
+  disabled?: boolean
   /** All configured content locales — one checkbox each (code + display label). */
   contentLocales: ReadonlyArray<AvailableLocalesWidgetLocale>
   /**
@@ -50,6 +51,7 @@ export interface AvailableLocalesWidgetProps {
  * `.byline-form-available-locales-list`.
  */
 export const AvailableLocalesWidget = ({
+  disabled: mutationsBlocked = false,
   contentLocales,
   availableVersionLocales,
 }: AvailableLocalesWidgetProps) => {
@@ -62,6 +64,7 @@ export const AvailableLocalesWidget = ({
 
   const toggle = useCallback(
     (code: string, checked: boolean) => {
+      if (mutationsBlocked) return
       const next = new Set(advertised)
       if (checked) {
         next.add(code)
@@ -70,7 +73,7 @@ export const AvailableLocalesWidget = ({
       }
       setSystemAvailableLocales([...next])
     },
-    [advertised, setSystemAvailableLocales]
+    [mutationsBlocked, advertised, setSystemAvailableLocales]
   )
 
   if (contentLocales.length === 0) {
@@ -102,7 +105,7 @@ export const AvailableLocalesWidget = ({
               label={label}
               intent={intent}
               checked={checked}
-              disabled={disabled}
+              disabled={mutationsBlocked || disabled}
               onCheckedChange={(value) => toggle(code, value === true)}
             />
           )

package/src/forms/document-actions.tsx

@@ -41,6 +41,7 @@ export interface DocumentActionsLocaleOption {
 }
 
 export function DocumentActions({
+  disabled = false,
   publishedVersion,
   onUnpublish,
   onDelete,
@@ -59,6 +60,7 @@ export function DocumentActions({
   onConfirmScheduledPublication,
   onCancelScheduledPublication,
 }: {
+  disabled?: boolean
   publishedVersion?: PublishedVersionInfo | null
   onUnpublish?: () => Promise<void>
   onDelete?: () => Promise<void>
@@ -221,24 +223,29 @@ export function DocumentActions({
     onDelete != null
 
   const handleOnDelete = () => {
+    if (disabled) return
     setShowDeleteConfirm(false)
     if (onDelete) {
-      onDelete()
+      void onDelete().catch(() => {})
     }
   }
 
   const handleOnDuplicate = async () => {
+    if (disabled) return
     if (!onDuplicate) return
     setDuplicateBusy(true)
     try {
       await onDuplicate()
       setShowDuplicateConfirm(false)
+    } catch {
+      // The host reports the failure and retains the editor observation.
     } finally {
       setDuplicateBusy(false)
     }
   }
 
   const handleOpenDuplicate = () => {
+    if (disabled) return
     // Duplicate copies the saved version — block when the form is dirty so
     // unsaved edits are not silently dropped from the copy.
     if (hasUnsavedChanges) {
@@ -249,6 +256,7 @@ export function DocumentActions({
   }
 
   const handleOpenCopyToLocale = () => {
+    if (disabled) return
     // Copy-to-Locale reads the saved version — block when the form is dirty.
     if (hasUnsavedChanges) {
       onUnsavedChanges?.()
@@ -263,17 +271,21 @@ export function DocumentActions({
   }
 
   const handleOnCopyToLocale = async () => {
+    if (disabled) return
     if (!onCopyToLocale || !copyTargetLocale) return
     setCopyToLocaleBusy(true)
     try {
       await onCopyToLocale({ targetLocale: copyTargetLocale, overwrite: copyOverwrite })
       setShowCopyToLocaleConfirm(false)
+    } catch {
+      // The host reports the failure and retains the editor observation.
     } finally {
       setCopyToLocaleBusy(false)
     }
   }
 
   const handleOpenDeleteLocale = () => {
+    if (disabled) return
     // Delete-Locale removes the saved version's locale content — block when
     // the form is dirty so the editor saves (or discards) first.
     if (hasUnsavedChanges) {
@@ -288,11 +300,14 @@ export function DocumentActions({
   }
 
   const handleOnDeleteLocale = async () => {
+    if (disabled) return
     if (!onDeleteLocale || !deleteTargetLocale) return
     setDeleteLocaleBusy(true)
     try {
       await onDeleteLocale({ targetLocale: deleteTargetLocale })
       setShowDeleteLocaleConfirm(false)
+    } catch {
+      // The host reports the failure and retains the editor observation.
     } finally {
       setDeleteLocaleBusy(false)
     }
@@ -311,6 +326,7 @@ export function DocumentActions({
       {hasAnyAction && (
         <DropdownComponent.Root>
           <DropdownComponent.Trigger
+            disabled={disabled}
             render={<IconButton variant="text" intent="noeffect" size="sm" />}
           >
             <EllipsisIcon
@@ -329,7 +345,7 @@ export function DocumentActions({
             >
               {/*{publishedVersion && (
               <>
-                <DropdownComponent.Item onClick={onUnpublish}>
+                <DropdownComponent.Item disabled={disabled} onClick={onUnpublish}>
                   <div className={cx('byline-form-actions-item', styles.item)}>
                     <span className={cx('byline-form-actions-item-icon', styles['item-icon'])} />
                     <span className={cx('byline-form-actions-item-text', styles['item-text'])}>
@@ -343,10 +359,16 @@ export function DocumentActions({
               {schedulingActions.length > 0 && (
                 <>
                   {schedulingActions.map((action) => (
-                    <DropdownComponent.Item key={action.key} onClick={action.onSelect}>
+                    <DropdownComponent.Item
+                      disabled={disabled}
+                      key={action.key}
+                      onClick={action.onSelect}
+                    >
                       <div className={cx('byline-form-actions-item', styles.item)}>
                         <span className={cx('byline-form-actions-item-text', styles['item-text'])}>
-                          <button type="button">{action.label}</button>
+                          <button type="button" disabled={disabled}>
+                            {action.label}
+                          </button>
                         </span>
                       </div>
                     </DropdownComponent.Item>
@@ -355,28 +377,34 @@ export function DocumentActions({
                 </>
               )}
               {copyToLocaleAvailable && (
-                <DropdownComponent.Item onClick={handleOpenCopyToLocale}>
+                <DropdownComponent.Item disabled={disabled} onClick={handleOpenCopyToLocale}>
                   <div className={cx('byline-form-actions-item', styles.item)}>
                     <span className={cx('byline-form-actions-item-text', styles['item-text'])}>
-                      <button type="button">{t('documentActions.copyToLocaleMenuItem')}</button>
+                      <button type="button" disabled={disabled}>
+                        {t('documentActions.copyToLocaleMenuItem')}
+                      </button>
                     </span>
                   </div>
                 </DropdownComponent.Item>
               )}
               {deleteLocaleAvailable && (
-                <DropdownComponent.Item onClick={handleOpenDeleteLocale}>
+                <DropdownComponent.Item disabled={disabled} onClick={handleOpenDeleteLocale}>
                   <div className={cx('byline-form-actions-item', styles.item)}>
                     <span className={cx('byline-form-actions-item-text', styles['item-text'])}>
-                      <button type="button">{t('documentActions.deleteLocale.menuItem')}</button>
+                      <button type="button" disabled={disabled}>
+                        {t('documentActions.deleteLocale.menuItem')}
+                      </button>
                     </span>
                   </div>
                 </DropdownComponent.Item>
               )}
               {onDuplicate && (
-                <DropdownComponent.Item onClick={handleOpenDuplicate}>
+                <DropdownComponent.Item disabled={disabled} onClick={handleOpenDuplicate}>
                   <div className={cx('byline-form-actions-item', styles.item)}>
                     <span className={cx('byline-form-actions-item-text', styles['item-text'])}>
-                      <button type="button">{t('common.actions.duplicate')}</button>
+                      <button type="button" disabled={disabled}>
+                        {t('common.actions.duplicate')}
+                      </button>
                     </span>
                   </div>
                 </DropdownComponent.Item>
@@ -385,6 +413,7 @@ export function DocumentActions({
                 <>
                   <DropdownComponent.Separator />
                   <DropdownComponent.Item
+                    disabled={disabled}
                     onClick={() => {
                       setShowDeleteConfirm(true)
                     }}
@@ -454,7 +483,13 @@ export function DocumentActions({
             >
               {t('common.actions.cancel')}
             </Button>
-            <Button size="sm" style={{ minWidth: '80px' }} intent="danger" onClick={handleOnDelete}>
+            <Button
+              size="sm"
+              style={{ minWidth: '80px' }}
+              intent="danger"
+              disabled={disabled}
+              onClick={handleOnDelete}
+            >
               {t('common.actions.delete')}
             </Button>
           </Modal.Actions>
@@ -533,7 +568,7 @@ export function DocumentActions({
               onClick={() => {
                 if (!duplicateBusy) setShowDuplicateConfirm(false)
               }}
-              disabled={duplicateBusy}
+              disabled={disabled || duplicateBusy}
             >
               {t('common.actions.cancel')}
             </Button>
@@ -542,7 +577,7 @@ export function DocumentActions({
               style={{ minWidth: '80px' }}
               intent="primary"
               onClick={handleOnDuplicate}
-              disabled={duplicateBusy}
+              disabled={disabled || duplicateBusy}
             >
               {duplicateBusy
                 ? t('documentActions.duplicate.busyButton')
@@ -611,7 +646,7 @@ export function DocumentActions({
                 onValueChange={(value) => {
                   if (value != null) setCopyTargetLocale(value)
                 }}
-                disabled={copyToLocaleBusy}
+                disabled={disabled || copyToLocaleBusy}
               />
             </div>
             <div
@@ -623,7 +658,7 @@ export function DocumentActions({
                 name="overwrite"
                 label={t('documentActions.copyToLocale.overwriteLabel')}
                 checked={copyOverwrite}
-                disabled={copyToLocaleBusy}
+                disabled={disabled || copyToLocaleBusy}
                 helpText={t('documentActions.copyToLocale.overwriteHelp')}
                 onCheckedChange={(value) => {
                   setCopyOverwrite(value === true)
@@ -647,7 +682,7 @@ export function DocumentActions({
               onClick={() => {
                 if (!copyToLocaleBusy) setShowCopyToLocaleConfirm(false)
               }}
-              disabled={copyToLocaleBusy}
+              disabled={disabled || copyToLocaleBusy}
             >
               {t('common.actions.cancel')}
             </Button>
@@ -656,7 +691,7 @@ export function DocumentActions({
               style={{ minWidth: '80px' }}
               intent="primary"
               onClick={handleOnCopyToLocale}
-              disabled={copyToLocaleBusy || !copyTargetLocale}
+              disabled={disabled || copyToLocaleBusy || !copyTargetLocale}
             >
               {copyToLocaleBusy
                 ? t('documentActions.copyToLocale.busyButton')
@@ -711,7 +746,7 @@ export function DocumentActions({
                 onValueChange={(value) => {
                   if (value != null) setDeleteTargetLocale(value)
                 }}
-                disabled={deleteLocaleBusy}
+                disabled={disabled || deleteLocaleBusy}
               />
             </div>
             <p style={{ marginTop: 'var(--spacing-12)' }}>
@@ -734,7 +769,7 @@ export function DocumentActions({
               onClick={() => {
                 if (!deleteLocaleBusy) setShowDeleteLocaleConfirm(false)
               }}
-              disabled={deleteLocaleBusy}
+              disabled={disabled || deleteLocaleBusy}
             >
               {t('common.actions.cancel')}
             </Button>
@@ -743,7 +778,7 @@ export function DocumentActions({
               style={{ minWidth: '80px' }}
               intent="danger"
               onClick={handleOnDeleteLocale}
-              disabled={deleteLocaleBusy || !deleteTargetLocale}
+              disabled={disabled || deleteLocaleBusy || !deleteTargetLocale}
             >
               {deleteLocaleBusy
                 ? t('documentActions.deleteLocale.busyButton')