@localazy/strapi-plugin 1.4.0 → 1.6.0

package/README.md

@@ -71,6 +71,36 @@ localazy: {
   },
 ```
 
+## 🔐 Access control (RBAC)
+
+The plugin registers four Strapi permission actions, all visible under
+**Settings → Administration Panel → Roles → Plugins → Localazy** (grouped
+by `General` and `Settings` sub-categories):
+
+| Action                                                              | Unlocks                                                                                                                                                                                                                                                                               |
+| ------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `Localazy → Read` (`plugin::localazy.read`)                         | Localazy menu link, Overview, Activity Logs (list + detail), Content-Manager side panel & Localazy status column, read endpoints (identity, project, models, plugin settings, **content-transfer-setup**, sync cursor, activity logs, troubleshooting bundle, entry-exclusion state). |
+| `Localazy → Transfer` (`plugin::localazy.transfer`)                 | Upload, Download, Entry Exclusion mutations (incl. Content-Manager bulk actions), Activity Log session clearing. Reading the content-transfer-setup is bundled under `Read` above so transfer-only roles can still open the Upload/Download pages.                                    |
+| `Localazy → Settings → Read` (`plugin::localazy.settings.read`)     | Adds the Localazy Settings menu links (Global Settings, Content Transfer Setup) to the admin sidebar. Form controls render read-only — Save, Cancel, the Content Transfer Setup tree, and the webhook setup buttons are disabled without `Settings → Update`.                         |
+| `Localazy → Settings → Update` (`plugin::localazy.settings.update`) | **Connecting / disconnecting the Localazy account**, webhook setup, updating Content Transfer Setup, and updating Global Settings.                                                                                                                                                    |
+
+> **Note:** the **Webhook author** picker in _Localazy Settings → Global
+> Settings_ populates from Strapi's core `/admin/users` endpoint, which is
+> gated by Strapi's own `admin::users.read` permission — independent of the
+> plugin's actions. A role with only the plugin's `Settings → Read` will
+> still see the rest of the page; the author dropdown silently falls back
+> to an empty list.
+
+Server is the enforcement perimeter — all admin-typed plugin routes are
+gated by `admin::hasPermissions`, so UI gates are convenience only.
+
+### Upgrade note
+
+Strapi grants new actions to the **Super Admin** role automatically. **Other
+roles (Editor, Author, custom roles) keep no Localazy access until an admin
+re-grants the actions** under _Settings → Administration Panel → Roles →
+Plugins → Localazy_. Plan this step when upgrading from `<= 1.4.x`.
+
 ## 🛟 Support
 
 If you encounter any issues or have questions, feel free to contact us through whichever channel suits you best:

package/dist/_chunks/{FetchIdentity-Cor4ooZv.mjs → FetchIdentity-Bm7bc5bS.mjs}

@@ -1,8 +1,9 @@
-import { c as createStrapiApiAxiosInstance } from "./strapi-api-base-CAzGcwF6.mjs";
-import { V as darkTheme, W as lightTheme } from "./index-BjL9XpRh.mjs";
+import { c as createStrapiApiAxiosInstance } from "./strapi-api-base-IiMEtDoH.mjs";
+import { jsx } from "react/jsx-runtime";
+import { c as Flex, L as Loader, V as darkTheme, W as lightTheme } from "./index-shryj0jT.mjs";
+import { u as useTranslation } from "./useTranslation-CZQ4lU1m.mjs";
 import { createGlobalStyle } from "styled-components";
 import { useState, useMemo, createContext, useContext, useEffect } from "react";
-import { jsx } from "react/jsx-runtime";
 const emptyIdentity = {
   accessToken: "",
   project: {
@@ -72,6 +73,17 @@ class PluginSettingsService {
       throw e;
     }
   }
+  // Read-gated counterpart for per-user UI prefs (last visited route, sort
+  // prefs). Server filters the body to a fixed allowlist; sending anything else
+  // is silently dropped, so callers must only pass UI-pref fields here.
+  static async updatePluginSettingsUiPrefs(data) {
+    try {
+      const result = await axiosInstance.put(`${BASE_PATH$1}/ui-prefs`, data);
+      return result.data;
+    } catch (e) {
+      throw e;
+    }
+  }
   static async getSyncCursor() {
     try {
       const result = await axiosInstance.get(`${BASE_PATH$1}/sync-cursor`);
@@ -81,6 +93,10 @@ class PluginSettingsService {
     }
   }
 }
+function PluginPageLoader() {
+  const { t } = useTranslation();
+  return /* @__PURE__ */ jsx(Flex, { marginTop: 10, alignItems: "center", justifyContent: "center", children: /* @__PURE__ */ jsx(Loader, { children: t("common.loading_content") }) });
+}
 const BASE_PATH = "/user";
 const strapiApiInstance = createStrapiApiAxiosInstance();
 class LocalazyUserService {
@@ -501,9 +517,9 @@ function cacheHas(cache, key) {
   return cache.has(key);
 }
 var Set = getNative(root, "Set");
-function setToArray(set2) {
-  var index = -1, result = Array(set2.size);
-  set2.forEach(function(value) {
+function setToArray(set) {
+  var index = -1, result = Array(set.size);
+  set.forEach(function(value) {
     result[++index] = value;
   });
   return result;
@@ -937,32 +953,6 @@ var CLONE_DEEP_FLAG = 1, CLONE_SYMBOLS_FLAG = 4;
 function cloneDeep(value) {
   return baseClone(value, CLONE_DEEP_FLAG | CLONE_SYMBOLS_FLAG);
 }
-function baseSet(object, path, value, customizer) {
-  if (!isObject(object)) {
-    return object;
-  }
-  path = castPath(path, object);
-  var index = -1, length = path.length, lastIndex = length - 1, nested = object;
-  while (nested != null && ++index < length) {
-    var key = toKey(path[index]), newValue = value;
-    if (key === "__proto__" || key === "constructor" || key === "prototype") {
-      return object;
-    }
-    if (index != lastIndex) {
-      var objValue = nested[key];
-      newValue = void 0;
-      if (newValue === void 0) {
-        newValue = isObject(objValue) ? objValue : isIndex(path[index + 1]) ? [] : {};
-      }
-    }
-    assignValue(nested, key, newValue);
-    nested = nested[key];
-  }
-  return object;
-}
-function set(object, path, value) {
-  return object == null ? object : baseSet(object, path, value);
-}
 const FetchIdentity = () => {
   const { setIdentity, setIsFetchingIdentity } = useLocalazyIdentity();
   useEffect(() => {
@@ -991,10 +981,10 @@ export {
   PluginSettingsService as P,
   SetCache as S,
   Uint8Array as U,
-  cacheHas as a,
-  Symbol$1 as b,
+  PluginPageLoader as a,
+  cacheHas as b,
   cloneDeep as c,
-  setToArray as d,
+  Symbol$1 as d,
   eq as e,
   getAllKeys as f,
   getDefaultTheme as g,
@@ -1004,15 +994,17 @@ export {
   isTypedArray as k,
   isArray as l,
   isObjectLike as m,
-  keys as n,
-  isArrayLike as o,
-  arrayEach as p,
-  isObject as q,
-  castPath as r,
-  set as s,
+  isObject as n,
+  castPath as o,
+  isIndex as p,
+  assignValue as q,
+  keys as r,
+  setToArray as s,
   toKey as t,
   useLocalazyIdentity as u,
-  Set as v,
-  LocalazyUserService as w,
-  emptyIdentity as x
+  isArrayLike as v,
+  arrayEach as w,
+  Set as x,
+  LocalazyUserService as y,
+  emptyIdentity as z
 };

package/dist/_chunks/{FetchIdentity-BpFOT163.js → FetchIdentity-CcEjakiz.js}

@@ -1,9 +1,10 @@
 "use strict";
-const strapiApiBase = require("./strapi-api-base-IG3Pe5Sg.js");
+const strapiApiBase = require("./strapi-api-base-CCUuu7EY.js");
+const jsxRuntime = require("react/jsx-runtime");
 const index = require("./index-CTkxoioB.js");
+const useTranslation = require("./useTranslation-BdIl-aLe.js");
 const styled = require("styled-components");
 const React = require("react");
-const jsxRuntime = require("react/jsx-runtime");
 const emptyIdentity = {
   accessToken: "",
   project: {
@@ -73,6 +74,17 @@ class PluginSettingsService {
       throw e;
     }
   }
+  // Read-gated counterpart for per-user UI prefs (last visited route, sort
+  // prefs). Server filters the body to a fixed allowlist; sending anything else
+  // is silently dropped, so callers must only pass UI-pref fields here.
+  static async updatePluginSettingsUiPrefs(data) {
+    try {
+      const result = await axiosInstance.put(`${BASE_PATH$1}/ui-prefs`, data);
+      return result.data;
+    } catch (e) {
+      throw e;
+    }
+  }
   static async getSyncCursor() {
     try {
       const result = await axiosInstance.get(`${BASE_PATH$1}/sync-cursor`);
@@ -82,6 +94,10 @@ class PluginSettingsService {
     }
   }
 }
+function PluginPageLoader() {
+  const { t } = useTranslation.useTranslation();
+  return /* @__PURE__ */ jsxRuntime.jsx(index.Flex, { marginTop: 10, alignItems: "center", justifyContent: "center", children: /* @__PURE__ */ jsxRuntime.jsx(index.Loader, { children: t("common.loading_content") }) });
+}
 const BASE_PATH = "/user";
 const strapiApiInstance = strapiApiBase.createStrapiApiAxiosInstance();
 class LocalazyUserService {
@@ -502,9 +518,9 @@ function cacheHas(cache, key) {
   return cache.has(key);
 }
 var Set = getNative(root, "Set");
-function setToArray(set2) {
-  var index2 = -1, result = Array(set2.size);
-  set2.forEach(function(value) {
+function setToArray(set) {
+  var index2 = -1, result = Array(set.size);
+  set.forEach(function(value) {
     result[++index2] = value;
   });
   return result;
@@ -938,32 +954,6 @@ var CLONE_DEEP_FLAG = 1, CLONE_SYMBOLS_FLAG = 4;
 function cloneDeep(value) {
   return baseClone(value, CLONE_DEEP_FLAG | CLONE_SYMBOLS_FLAG);
 }
-function baseSet(object, path, value, customizer) {
-  if (!isObject(object)) {
-    return object;
-  }
-  path = castPath(path, object);
-  var index2 = -1, length = path.length, lastIndex = length - 1, nested = object;
-  while (nested != null && ++index2 < length) {
-    var key = toKey(path[index2]), newValue = value;
-    if (key === "__proto__" || key === "constructor" || key === "prototype") {
-      return object;
-    }
-    if (index2 != lastIndex) {
-      var objValue = nested[key];
-      newValue = void 0;
-      if (newValue === void 0) {
-        newValue = isObject(objValue) ? objValue : isIndex(path[index2 + 1]) ? [] : {};
-      }
-    }
-    assignValue(nested, key, newValue);
-    nested = nested[key];
-  }
-  return object;
-}
-function set(object, path, value) {
-  return object == null ? object : baseSet(object, path, value);
-}
 const FetchIdentity = () => {
   const { setIdentity, setIsFetchingIdentity } = useLocalazyIdentity();
   React.useEffect(() => {
@@ -989,6 +979,7 @@ exports.FetchIdentity = FetchIdentity;
 exports.HeadingFixGlobalStyle = HeadingFixGlobalStyle;
 exports.LocalazyIdentityProvider = LocalazyIdentityProvider;
 exports.LocalazyUserService = LocalazyUserService;
+exports.PluginPageLoader = PluginPageLoader;
 exports.PluginSettingsService = PluginSettingsService;
 exports.Set = Set;
 exports.SetCache = SetCache;
@@ -996,6 +987,7 @@ exports.Stack = Stack;
 exports.Symbol = Symbol$1;
 exports.Uint8Array = Uint8Array;
 exports.arrayEach = arrayEach;
+exports.assignValue = assignValue;
 exports.cacheHas = cacheHas;
 exports.castPath = castPath;
 exports.cloneDeep = cloneDeep;
@@ -1006,11 +998,11 @@ exports.getDefaultTheme = getDefaultTheme;
 exports.isArray = isArray;
 exports.isArrayLike = isArrayLike;
 exports.isBuffer = isBuffer;
+exports.isIndex = isIndex;
 exports.isObject = isObject;
 exports.isObjectLike = isObjectLike;
 exports.isTypedArray = isTypedArray;
 exports.keys = keys;
-exports.set = set;
 exports.setToArray = setToArray;
 exports.toKey = toKey;
 exports.useLocalazyIdentity = useLocalazyIdentity;

package/dist/_chunks/{LanguagesSelector-BbrMKwQY.mjs → LanguagesSelector-B1rwN7-Y.mjs}

@@ -1,8 +1,8 @@
-import { c as createStrapiApiAxiosInstance } from "./strapi-api-base-CAzGcwF6.mjs";
+import { c as createStrapiApiAxiosInstance } from "./strapi-api-base-IiMEtDoH.mjs";
 import { jsxs, jsx } from "react/jsx-runtime";
 import { useState, useEffect } from "react";
-import { c as cloneDeep } from "./FetchIdentity-Cor4ooZv.mjs";
-import { F as Field, M as MultiSelect, b as MultiSelectOption } from "./index-BjL9XpRh.mjs";
+import { c as cloneDeep } from "./FetchIdentity-Bm7bc5bS.mjs";
+import { F as Field, M as MultiSelect, b as MultiSelectOption } from "./index-shryj0jT.mjs";
 import { u as useTranslation } from "./useTranslation-CZQ4lU1m.mjs";
 const strapiApiInstance = createStrapiApiAxiosInstance();
 class ProjectService {
@@ -48,6 +48,7 @@ const LanguagesSelector = (props) => {
         onClear: () => setSelectedLanguages([]),
         value: selectedLanguages || [],
         onChange: (values) => onChange(values),
+        disabled: props.disabled,
         multi: true,
         withTags: true,
         children: props.projectLanguages.map((lang) => /* @__PURE__ */ jsx(MultiSelectOption, { value: lang.code, children: `${lang.name} (${lang.code})` }, lang.id))

package/dist/_chunks/{LanguagesSelector-CC1ecWnc.js → LanguagesSelector-DejYCwBl.js}

@@ -1,8 +1,8 @@
 "use strict";
-const strapiApiBase = require("./strapi-api-base-IG3Pe5Sg.js");
+const strapiApiBase = require("./strapi-api-base-CCUuu7EY.js");
 const jsxRuntime = require("react/jsx-runtime");
 const React = require("react");
-const FetchIdentity = require("./FetchIdentity-BpFOT163.js");
+const FetchIdentity = require("./FetchIdentity-CcEjakiz.js");
 const index = require("./index-CTkxoioB.js");
 const useTranslation = require("./useTranslation-BdIl-aLe.js");
 const strapiApiInstance = strapiApiBase.createStrapiApiAxiosInstance();
@@ -49,6 +49,7 @@ const LanguagesSelector = (props) => {
         onClear: () => setSelectedLanguages([]),
         value: selectedLanguages || [],
         onChange: (values) => onChange(values),
+        disabled: props.disabled,
         multi: true,
         withTags: true,
         children: props.projectLanguages.map((lang) => /* @__PURE__ */ jsxRuntime.jsx(index.MultiSelectOption, { value: lang.code, children: `${lang.name} (${lang.code})` }, lang.id))

package/dist/_chunks/{LocalazyApp-DpFR8p10.mjs → LocalazyApp-C4kbsnQh.mjs}

@@ -1,16 +1,16 @@
 import { jsx, jsxs, Fragment } from "react/jsx-runtime";
 import { useNavigate, useLocation, NavLink, useParams, Routes, Route } from "react-router-dom";
-import { o as ForwardRef$2H, p as ForwardRef$d, q as ForwardRef$3P, r as ForwardRef$4j, c as Flex, L as Loader, e as Button, B as Box, T as Typography, g as Link, s as SubNav, t as SubNavHeader, u as SubNavSections, v as SubNavSection, w as SubNavLink, x as ForwardRef$L, G as Grid, j as Divider, f as ForwardRef$3, A as Alert, D as Dialog, y as ForwardRef$4L, z as ForwardRef$4N, P as Pagination, E as PreviousLink, H as PageLink, I as Dots, N as NextLink, J as lodashExports, K as ForwardRef$j, i as ForwardRef$2x, F as Field, O as DatePicker$1, Q as Tabs, R as TooltipImpl, U as ForwardRef$57, l as DesignSystemProvider } from "./index-BjL9XpRh.mjs";
+import { o as ForwardRef$2H, p as ForwardRef$d, q as ForwardRef$3P, r as ForwardRef$4j, e as Button, s as TooltipImpl, B as Box, T as Typography, g as Link, t as SubNav, u as SubNavHeader, v as SubNavSections, w as SubNavSection, x as SubNavLink, y as ForwardRef$L, G as Grid, j as Divider, c as Flex, f as ForwardRef$3, A as Alert, D as Dialog, z as ForwardRef$4L, E as ForwardRef$4N, P as Pagination, H as PreviousLink, I as PageLink, J as Dots, N as NextLink, K as lodashExports, O as ForwardRef$j, i as ForwardRef$2x, F as Field, Q as DatePicker$1, R as Tabs, U as ForwardRef$57, l as DesignSystemProvider } from "./index-shryj0jT.mjs";
 import React__default, { useState, useEffect, useCallback, useMemo, useRef } from "react";
-import { u as useLocalazyIdentity, w as LocalazyUserService, x as emptyIdentity, P as PluginSettingsService, c as cloneDeep, s as set, g as getDefaultTheme, H as HeadingFixGlobalStyle, L as LocalazyIdentityProvider, F as FetchIdentity } from "./FetchIdentity-Cor4ooZv.mjs";
-import { P as PLUGIN_ID } from "./index-C9hN3KbD.mjs";
+import { u as useLocalazyIdentity, a as PluginPageLoader, y as LocalazyUserService, z as emptyIdentity, P as PluginSettingsService, g as getDefaultTheme, H as HeadingFixGlobalStyle, L as LocalazyIdentityProvider, F as FetchIdentity } from "./FetchIdentity-Bm7bc5bS.mjs";
+import { a as PLUGIN_ID, P as PERMISSIONS } from "./index-DP2ugzc_.mjs";
 import { u as useTranslation } from "./useTranslation-CZQ4lU1m.mjs";
 import { g as getDefaultExportFromCjs } from "./_commonjsHelpers-DWwsNxpa.mjs";
-import { c as createStrapiApiAxiosInstance } from "./strapi-api-base-CAzGcwF6.mjs";
-import { P as ProjectService, L as LanguagesSelector } from "./LanguagesSelector-BbrMKwQY.mjs";
-import { Layouts, useAuth, useNotification, Page } from "@strapi/strapi/admin";
-import "./i18n-o24yXf-j.mjs";
-import { h as hasModelChanged } from "./has-model-changed-Dp2Vkwjw.mjs";
+import { useRBAC, Layouts, useAuth, useNotification, Page } from "@strapi/strapi/admin";
+import { c as createStrapiApiAxiosInstance } from "./strapi-api-base-IiMEtDoH.mjs";
+import { P as ProjectService, L as LanguagesSelector } from "./LanguagesSelector-B1rwN7-Y.mjs";
+import "./i18n-76ox2llT.mjs";
+import { h as hasModelChanged } from "./has-model-changed-CVJEuGxM.mjs";
 import { useTheme } from "styled-components";
 var PLUGIN_ROUTES = /* @__PURE__ */ ((PLUGIN_ROUTES2) => {
   PLUGIN_ROUTES2["ROOT"] = "";
@@ -98,10 +98,6 @@ const useHeaderSubtitle = () => {
   const currentNavItem = navigation.find((navItem) => pluginSegment.includes(navItem.id));
   return currentNavItem?.description || "";
 };
-function PluginPageLoader() {
-  const { t: t2 } = useTranslation();
-  return /* @__PURE__ */ jsx(Flex, { marginTop: 10, alignItems: "center", justifyContent: "center", children: /* @__PURE__ */ jsx(Loader, { children: t2("common.loading_content") }) });
-}
 var propTypes = { exports: {} };
 var reactIs = { exports: {} };
 var reactIs_production_min = {};
@@ -1258,6 +1254,8 @@ if (process.env.STRAPI_ADMIN_LOCALAZY_ENV === "development") {
 }
 const LoginButton = (props) => {
   const { t: t2 } = useTranslation();
+  const { allowedActions } = useRBAC(PERMISSIONS.SETTINGS_UPDATE);
+  const canConnect = !!allowedActions.canUpdate;
   const [isLoading, setIsLoading] = useState(false);
   const login = async () => {
     setIsLoading(true);
@@ -1278,7 +1276,8 @@ const LoginButton = (props) => {
     setIsLoading(false);
     props.onResultFetched(pollResult);
   };
-  return /* @__PURE__ */ jsx("div", { children: /* @__PURE__ */ jsx(Button, { variant: "default", size: "L", loading: isLoading, onClick: login, children: t2("login.login_with_localazy") }) });
+  const button = /* @__PURE__ */ jsx(Button, { variant: "default", size: "L", loading: isLoading, onClick: login, disabled: !canConnect, children: t2("login.login_with_localazy") });
+  return /* @__PURE__ */ jsx("div", { children: canConnect ? button : /* @__PURE__ */ jsx(TooltipImpl, { label: t2("login.requires_settings_update_permission"), children: /* @__PURE__ */ jsx("span", { children: button }) }) });
 };
 LoginButton.propTypes = {
   onResultFetched: PropTypes.func.isRequired
@@ -1436,6 +1435,8 @@ const LogoutButton = (props) => {
   const { t: t2 } = useTranslation();
   const [isLoading, setIsLoading] = useState(false);
   const { setIdentity } = useLocalazyIdentity();
+  const { allowedActions } = useRBAC(PERMISSIONS.SETTINGS_UPDATE);
+  const canDisconnect = !!allowedActions.canUpdate;
   const logout = async () => {
     setIsLoading(true);
     void LocalazyUserService.deleteIdentity();
@@ -1443,7 +1444,8 @@ const LogoutButton = (props) => {
     setIsLoading(false);
     props.onResultFetched();
   };
-  return /* @__PURE__ */ jsx("div", { children: /* @__PURE__ */ jsx(Button, { startIcon: /* @__PURE__ */ jsx(ForwardRef$L, {}), variant: "secondary", loading: isLoading, onClick: logout, children: t2("login.logout_from_localazy") }) });
+  const button = /* @__PURE__ */ jsx(Button, { startIcon: /* @__PURE__ */ jsx(ForwardRef$L, {}), variant: "secondary", loading: isLoading, onClick: logout, disabled: !canDisconnect, children: t2("login.logout_from_localazy") });
+  return /* @__PURE__ */ jsx("div", { children: canDisconnect ? button : /* @__PURE__ */ jsx(TooltipImpl, { label: t2("login.requires_settings_update_permission"), children: /* @__PURE__ */ jsx("span", { children: button }) }) });
 };
 const OverviewItem = (props) => {
   return /* @__PURE__ */ jsxs(Grid.Root, { padding: 1, col: 6, s: 12, children: [
@@ -1474,7 +1476,7 @@ const Overview = ({ title, subtitle, isLoadingProp = false }) => {
       setIsLoading(true);
       const project = await ProjectService.getConnectedProject();
       setConnectedProject(project);
-      void PluginSettingsService.updatePluginSettings({ defaultRoute: PLUGIN_ROUTES.OVERVIEW });
+      void PluginSettingsService.updatePluginSettingsUiPrefs({ defaultRoute: PLUGIN_ROUTES.OVERVIEW });
       setIsLoading(false);
     }
     void initComponent();
@@ -5061,7 +5063,7 @@ const Upload = (props) => {
       setLocalazySourceLanguage(sourceLanguage);
       setModelChanged(modelChangedResult);
       setLocalesIncompatible(!localesCompatibleResult);
-      void PluginSettingsService.updatePluginSettings({ defaultRoute: PLUGIN_ROUTES.UPLOAD });
+      void PluginSettingsService.updatePluginSettingsUiPrefs({ defaultRoute: PLUGIN_ROUTES.UPLOAD });
       setIsLoading(false);
     }
     void initComponent();
@@ -5194,16 +5196,9 @@ const Download = (props) => {
     window.open(identity.project.url, "_blank");
   };
   const [projectLanguages, setProjectLanguages] = useState([]);
-  const [formModel, setFormModel] = useState({});
+  const [uiLanguages, setUiLanguages] = useState([]);
   const onDownloadLanguagesChange = (languages) => {
-    const newFormModel = cloneDeep(formModel);
-    set(newFormModel, "download.uiLanguages", languages);
-    setFormModel(newFormModel);
-    try {
-      void PluginSettingsService.updatePluginSettings(newFormModel);
-    } catch (e2) {
-      console.error(e2.message);
-    }
+    setUiLanguages(languages);
   };
   const onDownloadClick = async (fullSync = false) => {
     setIsDownloading(true);
@@ -5212,7 +5207,7 @@ const Download = (props) => {
       success: false,
       report: []
     });
-    const result = await LocalazyDownloadService.download({ fullSync });
+    const result = await LocalazyDownloadService.download({ fullSync, uiLanguages });
     const { streamIdentifier } = result;
     downloadAlertsService.setStreamIdentifier(streamIdentifier);
     downloadAlertsService.onDownload((data) => {
@@ -5253,8 +5248,8 @@ const Download = (props) => {
       setHasSyncCursor(syncCursor?.processedKeys !== void 0 && Object.keys(syncCursor.processedKeys).length > 0);
       const projectLanguagesWithoutDefaultLanguage = project?.languages?.filter((language) => language.id !== project.sourceLanguage) || [];
       setProjectLanguages(projectLanguagesWithoutDefaultLanguage);
-      setFormModel(globalSettings);
-      void PluginSettingsService.updatePluginSettings({ defaultRoute: PLUGIN_ROUTES.DOWNLOAD });
+      setUiLanguages(Array.isArray(globalSettings?.download?.uiLanguages) ? globalSettings.download.uiLanguages : []);
+      void PluginSettingsService.updatePluginSettingsUiPrefs({ defaultRoute: PLUGIN_ROUTES.DOWNLOAD });
       setIsLoading(false);
     }
     void initComponent();
@@ -5312,7 +5307,7 @@ const Download = (props) => {
             /* @__PURE__ */ jsx(Box, { paddingTop: 6, children: /* @__PURE__ */ jsx(
               LanguagesSelector,
               {
-                preselectedLanguages: formModel?.download?.uiLanguages || [],
+                preselectedLanguages: uiLanguages,
                 projectLanguages,
                 onChange: (languages) => onDownloadLanguagesChange(languages),
                 label: t2("download.ui_languages"),
@@ -5689,6 +5684,9 @@ const useDebouncedSearch = () => {
 const ActivityLogs = (props) => {
   const { t: t2 } = useTranslation();
   const navigate = useNavigate();
+  const {
+    allowedActions: { canTransfer }
+  } = useRBAC(PERMISSIONS.TRANSFER);
   const [isLoading, setIsLoading] = useState(true);
   const [sessions, setSessions] = useState([]);
   const [activeTab, setActiveTab] = useState("upload");
@@ -5702,7 +5700,7 @@ const ActivityLogs = (props) => {
   const debouncedSaveSortPrefs = useCallback((prefs) => {
     if (saveSortTimerRef.current) clearTimeout(saveSortTimerRef.current);
     saveSortTimerRef.current = setTimeout(() => {
-      void PluginSettingsService.updatePluginSettings({ activityLogsSort: prefs });
+      void PluginSettingsService.updatePluginSettingsUiPrefs({ activityLogsSort: prefs });
     }, 1e3);
   }, []);
   const onSortChange = (eventType, key, direction) => {
@@ -5758,7 +5756,7 @@ const ActivityLogs = (props) => {
       void fetchSessions("upload");
     };
     void init();
-    void PluginSettingsService.updatePluginSettings({ defaultRoute: PLUGIN_ROUTES.ACTIVITY_LOGS });
+    void PluginSettingsService.updatePluginSettingsUiPrefs({ defaultRoute: PLUGIN_ROUTES.ACTIVITY_LOGS });
   }, []);
   return /* @__PURE__ */ jsxs(Fragment, { children: [
     /* @__PURE__ */ jsx(
@@ -5768,7 +5766,16 @@ const ActivityLogs = (props) => {
         subtitle: props.subtitle,
         primaryAction: /* @__PURE__ */ jsxs(Flex, { gap: 2, children: [
           /* @__PURE__ */ jsx(Button, { variant: "secondary", startIcon: /* @__PURE__ */ jsx(ForwardRef$3P, {}), onClick: onExportLogs, children: t2("activity_logs.export_logs") }),
-          /* @__PURE__ */ jsx(Button, { variant: "danger-light", startIcon: /* @__PURE__ */ jsx(ForwardRef$j, {}), onClick: () => setShowClearConfirm(true), children: t2("activity_logs.clear_logs") })
+          /* @__PURE__ */ jsx(
+            Button,
+            {
+              variant: "danger-light",
+              startIcon: /* @__PURE__ */ jsx(ForwardRef$j, {}),
+              disabled: !canTransfer,
+              onClick: () => setShowClearConfirm(true),
+              children: t2("activity_logs.clear_logs")
+            }
+          )
         ] })
       }
     ),
@@ -6136,6 +6143,10 @@ const App = () => {
   const { isLoggedIn, isFetchingIdentity } = useLocalazyIdentity();
   const headerTitle = useHeaderTitle();
   const headerSubtitle = useHeaderSubtitle();
+  const {
+    allowedActions: { canRead, canTransfer },
+    isLoading: isLoadingPermissions
+  } = useRBAC([...PERMISSIONS.READ, ...PERMISSIONS.TRANSFER]);
   const normalizedPath = location2.pathname.replace(/\/+$/, "");
   const pluginRoot = `/plugins/${PLUGIN_ID}`;
   const isAtPluginRoot = normalizedPath === pluginRoot;
@@ -6157,6 +6168,19 @@ const App = () => {
     };
     void fetchData();
   }, [isLoggedIn, isFetchingIdentity, normalizedPath]);
+  if (isLoadingPermissions) {
+    return /* @__PURE__ */ jsxs(DesignSystemProvider, { theme: getDefaultTheme(), children: [
+      /* @__PURE__ */ jsx(HeadingFixGlobalStyle, {}),
+      /* @__PURE__ */ jsx(Box, { background: "neutral100", children: /* @__PURE__ */ jsx(Layouts.Root, { children: /* @__PURE__ */ jsx(PluginPageLoader, {}) }) })
+    ] });
+  }
+  if (!canRead) {
+    return /* @__PURE__ */ jsxs(DesignSystemProvider, { theme: getDefaultTheme(), children: [
+      /* @__PURE__ */ jsx(HeadingFixGlobalStyle, {}),
+      /* @__PURE__ */ jsx(Box, { background: "neutral100", children: /* @__PURE__ */ jsx(Layouts.Root, { children: /* @__PURE__ */ jsx(Page.NoPermissions, {}) }) })
+    ] });
+  }
+  const transferElement = (page) => canTransfer ? page : /* @__PURE__ */ jsx(Page.NoPermissions, {});
   return /* @__PURE__ */ jsxs(DesignSystemProvider, { theme: getDefaultTheme(), children: [
     /* @__PURE__ */ jsx(HeadingFixGlobalStyle, {}),
     /* @__PURE__ */ jsx(PluginErrorBoundary, { children: /* @__PURE__ */ jsx(Box, { background: "neutral100", children: /* @__PURE__ */ jsxs(Layouts.Root, { sideNav: isLoggedIn && /* @__PURE__ */ jsx(SideNav, {}), children: [
@@ -6176,8 +6200,20 @@ const App = () => {
             element: /* @__PURE__ */ jsx(Overview, { title: headerTitle, subtitle: headerSubtitle, isLoadingProp: false })
           }
         ),
-        /* @__PURE__ */ jsx(Route, { path: `upload`, element: /* @__PURE__ */ jsx(Upload, { title: headerTitle, subtitle: headerSubtitle }) }),
-        /* @__PURE__ */ jsx(Route, { path: `download`, element: /* @__PURE__ */ jsx(Download, { title: headerTitle, subtitle: headerSubtitle }) }),
+        /* @__PURE__ */ jsx(
+          Route,
+          {
+            path: `upload`,
+            element: transferElement(/* @__PURE__ */ jsx(Upload, { title: headerTitle, subtitle: headerSubtitle }))
+          }
+        ),
+        /* @__PURE__ */ jsx(
+          Route,
+          {
+            path: `download`,
+            element: transferElement(/* @__PURE__ */ jsx(Download, { title: headerTitle, subtitle: headerSubtitle }))
+          }
+        ),
         /* @__PURE__ */ jsx(Route, { path: `activity-logs`, element: /* @__PURE__ */ jsx(ActivityLogs, { title: headerTitle, subtitle: headerSubtitle }) }),
         /* @__PURE__ */ jsx(
           Route,