@nocobase/app-template-default 1.0.0-beta.84 → 1.0.0-beta.86

package/client/pages/settings/users.tsx

@@ -9,7 +9,12 @@ import {
 import { DataTable, DataTableColumnHeader } from '#components/data-table';
 import type { ColumnDef } from '@tanstack/react-table';
 import { useSettingsData, useUserPermission } from './hooks.js';
-import { useApiClient, useSubmission, useToaster } from '@nocobase/app-client';
+import {
+  resolveListState,
+  useApiClient,
+  useSubmission,
+  useToaster,
+} from '@nocobase/app-client';
 import { useTranslation } from '@nocobase/i18n/client';
 import {
   UsersClient,
@@ -25,12 +30,13 @@ import {
   type ReactElement,
 } from 'react';
 import { Link, Outlet, useLocation, useResolvedPath } from 'react-router';
-import { PlusIcon, UsersIcon } from 'lucide-react';
+import { PlusIcon } from 'lucide-react';
 import { PageContainer } from '#components/page-container';
 import { PageHeader } from '#components/page-header';
 import { Button } from '#components/ui/button';
 import { Input } from '#components/ui/input';
 import { StatusBadge } from '#components/status-badge';
+import { Spinner } from '#components/ui/spinner';
 import {
   Select,
   SelectTrigger,
@@ -38,14 +44,26 @@ import {
   SelectContent,
   SelectItem,
 } from '#components/ui/select';
-import {
-  Empty,
-  EmptyMedia,
-  EmptyTitle,
-  EmptyDescription,
-  EmptyContent,
-} from '#components/ui/empty';
-import { ConfirmAction, SettingsError, SettingsLoading } from './shared.js';
+import { ConfirmAction, SettingsError } from './shared.js';
+
+function UsersRefreshing(): ReactElement | null {
+  const { t } = useTranslation();
+  const [visible, setVisible] = useState(false);
+  useEffect(() => {
+    // Fast background reads should not flash feedback on overlay close.
+    const timer = setTimeout(() => setVisible(true), 300);
+    return () => clearTimeout(timer);
+  }, []);
+  return visible ? (
+    <span
+      role='status'
+      className='flex items-center gap-2 text-sm text-muted-foreground'
+    >
+      <Spinner aria-hidden='true' className='size-4' />
+      {t('settings.loading')}
+    </span>
+  ) : null;
+}
 
 function UserName({ user }: { readonly user: ManagedUser }): ReactElement {
   const canUpdate = useUserPermission('update', user.id);
@@ -273,10 +291,12 @@ export default function UsersPage(): ReactElement {
         }
       : {}),
   });
+  const requestPath = `users?${remote}`;
   const request = useSettingsData<{
     data: readonly ManagedUser[];
     meta: { total: number };
-  }>(`users?${remote}`, { keepPreviousData: true, active });
+  }>(requestPath, { keepPreviousData: true, active });
+  const hasCurrentResponse = request.path === requestPath;
   const tableState = useTableUrlState({
     active,
     revision: request.revision,
@@ -284,7 +304,9 @@ export default function UsersPage(): ReactElement {
     pageSizeOptions: [20, 50, 100],
     sortColumns: ['name'],
     rowCount:
-      !request.loading && !request.error ? request.data?.meta.total : undefined,
+      hasCurrentResponse && !request.loading && !request.error
+        ? request.data?.meta.total
+        : undefined,
   });
   const clearFilters = () => {
     setQuery('');
@@ -317,6 +339,24 @@ export default function UsersPage(): ReactElement {
   const canCreate = useUserPermission('create');
   const canAssign = useUserPermission('assign-role');
   const rows = request.data?.data ?? [];
+  const filtered =
+    Boolean(params.get('q') || roleScope || role) || status !== 'all';
+  const listState = resolveListState(
+    {
+      data: hasCurrentResponse ? request.data : undefined,
+      error: tableState.error ?? request.error,
+      isPending: request.loading && !hasCurrentResponse,
+    },
+    hasCurrentResponse ? (request.data?.meta.total ?? rows.length) : 0,
+    filtered,
+  );
+  const canShowCreate =
+    canCreate &&
+    canAssign &&
+    (listState === 'empty' ||
+      listState === 'ready' ||
+      listState === 'no-results' ||
+      listState === 'refresh-failed');
   const columns = useMemo<ColumnDef<ManagedUser>[]>(
     () => [
       {
@@ -389,8 +429,6 @@ export default function UsersPage(): ReactElement {
         {t('settings.newUser')}
       </Button>
     ) : null;
-  const filtered =
-    Boolean(params.get('q') || roleScope || role) || status !== 'all';
   return (
     <>
       <PageContainer>
@@ -400,7 +438,7 @@ export default function UsersPage(): ReactElement {
         <PageHeader
           title={t('settings.users')}
           description={t('settings.usersDescription')}
-          actions={rows.length || filtered ? create : undefined}
+          actions={canShowCreate ? create : undefined}
         />
         <div className='flex flex-wrap items-center gap-3'>
           <Input
@@ -472,73 +510,37 @@ export default function UsersPage(): ReactElement {
               ))}
             </SelectContent>
           </Select>
-          {filtered && (
+          {filtered && listState !== 'no-results' && (
             <Button variant='ghost' onClick={clearFilters}>
               {t('settings.clear')}
             </Button>
           )}
+          <div className='ml-auto flex h-8 w-28 items-center justify-end'>
+            {active && hasCurrentResponse && request.loading && request.data ? (
+              <UsersRefreshing />
+            ) : null}
+          </div>
         </div>
-        {request.data && request.loading && (
-          <span role='status' className='text-sm text-muted-foreground'>
-            {t('settings.loading')}
-          </span>
-        )}
         {Boolean(roleScope) !== Boolean(role) && (
           <p role='alert' className='text-sm text-destructive'>
             {t('settings.roleFilterIncomplete')}
           </p>
         )}
         <SettingsError error={options.error} retry={options.reload} />
-        <SettingsError
-          error={tableState.error ?? request.error}
-          retry={request.reload}
+        <DataTable<ManagedUser>
+          columns={columns}
+          data={rows}
+          getRowId={(row) => row.id}
+          manualPagination
+          rowCount={request.data?.meta.total ?? 0}
+          {...tableState}
+          manualSorting
+          showSelectedCount={false}
+          loading={request.loading}
+          listState={listState}
+          onRetry={request.reload}
+          onClearFilters={clearFilters}
         />
-        {request.loading && !request.data ? (
-          <SettingsLoading />
-        ) : (
-          !tableState.error &&
-          !request.error &&
-          (rows.length ? (
-            <DataTable<ManagedUser>
-              columns={columns}
-              data={rows}
-              getRowId={(row) => row.id}
-              manualPagination
-              rowCount={request.data?.meta.total ?? 0}
-              {...tableState}
-              manualSorting
-              showSelectedCount={false}
-              loading={request.loading}
-            />
-          ) : (
-            <Empty className='min-h-48 border border-dashed'>
-              <EmptyMedia variant='icon'>
-                <UsersIcon />
-              </EmptyMedia>
-              <EmptyTitle>
-                {t(filtered ? 'settings.noResults' : 'settings.noUsers')}
-              </EmptyTitle>
-              <EmptyDescription>
-                {t(
-                  filtered
-                    ? 'settings.clearHint'
-                    : canCreate && canAssign
-                      ? 'settings.usersDescription'
-                      : 'settings.usersReadOnlyEmpty',
-                )}
-              </EmptyDescription>
-              <EmptyContent>
-                {filtered ? (
-                  <Button variant='outline' onClick={clearFilters}>
-                    {t('settings.clear')}
-                  </Button>
-                ) : (
-                  create
-                )}
-              </EmptyContent>
-            </Empty>
-          ))
-        )}
         {request.data && (
           <p className='text-sm text-muted-foreground'>
             {t('settings.total', { count: request.data.meta.total })}

package/client/runtime.ts

@@ -5,10 +5,8 @@ import { defineAppRuntime } from '@nocobase/app-client/runtime';
 import locales from './locales/index.js';
 import plugins from './plugins.js';
 import reactProviders from './react-providers.js';
-import routeComponentOverrides from './route-overrides.js';
 import routes from './routes.js';
 import serviceProviders from './service-provider.js';
-import sourceExtensions from './source-extensions.js';
 
 const appRuntime = defineAppRuntime({
   packageName: '@nocobase/app-template-default',
@@ -19,8 +17,6 @@ const appRuntime = defineAppRuntime({
   reactProviders,
   routes,
   plugins,
-  routeComponentOverrides,
-  sourceExtensions,
 });
 
 export default appRuntime;

package/config.example.yml

@@ -70,6 +70,26 @@ secrets:
       key: replace-with-a-unique-secret
 
 auth:
+  # Authentication owns this sender; notification and mailbox configuration are independent.
+  # Set app.publicOrigin (or APP_PUBLIC_ORIGIN) before enabling automatic recovery.
+  # passwordReset:
+  #   enabled: true
+  # email:
+  #   provider: smtp
+  #   host: smtp.example.com
+  #   port: 587
+  #   secure: false
+  #   auth:
+  #     user: noreply@example.com
+  #     pass: replace-with-the-smtp-password
+  #   from: App <noreply@example.com>
+  #   replyTo: support@example.com
+  # For Resend, replace the entire email block with these fields; do not mix SMTP fields:
+  # email:
+  #   provider: resend
+  #   apiKey: replace-with-the-resend-api-key
+  #   from: App <noreply@example.com>
+  # AUTH_EMAIL_PROVIDER/HOST/PORT/SECURE/USER/PASSWORD/FROM/REPLY_TO/API_KEY override auth.email.
   emailAndPassword:
     enabled: true
     autoSignIn: false
@@ -146,9 +166,13 @@ snowflake:
 # process that is killed loses what changed since it started. It serves one process: every other process or instance
 # would run its own copy. Set default to memory to keep that without the startup warning, or to redis to run several.
 # Redis must persist its data (AOF or RDB) and use maxmemory-policy noeviction, or schedules can be lost.
+# Install the commercial @nocobase/app-plugin-jobs-redis package and register its Server plugin
+# from @nocobase/app-plugin-jobs-redis/server in server/plugins.ts on every producer and consumer.
+# Upgrading deployments must set adapter: redis explicitly; templates no longer supply Redis defaults.
 # jobs:
 #   default: redis
 #   redis:
+#     adapter: redis
 #     connection:
 #       host: 127.0.0.1
 #       port: 6379

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@nocobase/app-template-default",
   "displayName": "Default Template",
-  "version": "1.0.0-beta.84",
+  "version": "1.0.0-beta.86",
   "type": "module",
   "prettier": "@nocobase/dev-config/prettier",
   "engines": {
@@ -9,7 +9,7 @@
   },
   "nocobase": {
     "templateKind": "app",
-    "defaultTemplateVersion": "1.0.0-beta.84"
+    "defaultTemplateVersion": "1.0.0-beta.86"
   },
   "devDependencies": {
     "@ai-sdk/react": "4.0.131",
@@ -74,10 +74,10 @@
     "elkjs": "^0.10.2",
     "@types/jsdom": "^30.0.0",
     "@noble/hashes": "2.3.0",
-    "@nocobase/app-client": "^4.0.0-beta.4",
+    "@nocobase/app-client": "^4.0.0-beta.6",
     "@nocobase/app-plugin-template-print": "0.0.2-beta.2",
-    "@nocobase/app-skills": "0.1.0-beta.54",
-    "@nocobase/app-testing": "0.1.0-beta.6",
+    "@nocobase/app-skills": "0.1.0-beta.56",
+    "@nocobase/app-testing": "0.1.0-beta.7",
     "@nocobase/app-websocket": "^0.1.0-beta.1",
     "@nocobase/dev-config": "0.1.0-beta.25",
     "@nocobase/drive": "^0.1.0-beta.7",
@@ -142,39 +142,41 @@
     "@oclif/core": "^4.14.0",
     "better-auth": "1.7.5",
     "hono": "^4.13.2",
-    "@nocobase/app-plugin-agents": "^1.0.0-beta.28",
-    "@nocobase/app-plugin-api-keys": "^1.0.0-beta.19",
-    "@nocobase/app-plugin-authentication": "^2.0.0-beta.15",
-    "@nocobase/app-plugin-authorization": "^1.0.0-beta.33",
-    "@nocobase/app-plugin-database-explorer": "^1.0.0-beta.17",
-    "@nocobase/app-plugin-file": "^1.0.0-beta.27",
-    "@nocobase/app-plugin-foundation": "^0.1.0-beta.9",
-    "@nocobase/app-plugin-i18n": "^1.0.0-beta.18",
-    "@nocobase/app-plugin-knowledge": "^0.1.0-beta.14",
-    "@nocobase/app-plugin-mail": "^1.0.0-beta.17",
-    "@nocobase/app-plugin-notification": "^2.0.0-beta.1",
-    "@nocobase/app-plugin-notification-in-app": "^2.0.0-beta.0",
-    "@nocobase/app-plugin-notification-providers": "^1.0.0-beta.15",
-    "@nocobase/app-plugin-scheduler": "^1.0.0-beta.20",
-    "@nocobase/app-plugin-users": "^2.0.0-beta.11",
-    "@nocobase/app-server": "^3.0.0-beta.4",
+    "@nocobase/concurrency": "^0.1.0-beta.1",
+    "@nocobase/app-plugin-concurrency": "^0.1.0-beta.1",
+    "@nocobase/app-plugin-agents": "^2.0.0-beta.1",
+    "@nocobase/app-plugin-api-keys": "^1.0.0-beta.20",
+    "@nocobase/app-plugin-authentication": "^2.0.0-beta.17",
+    "@nocobase/app-plugin-authorization": "^1.0.0-beta.34",
+    "@nocobase/app-plugin-database-explorer": "^1.0.0-beta.18",
+    "@nocobase/app-plugin-file": "^1.0.0-beta.28",
+    "@nocobase/app-plugin-foundation": "^0.1.0-beta.11",
+    "@nocobase/app-plugin-i18n": "^1.0.0-beta.19",
+    "@nocobase/app-plugin-knowledge": "^0.1.0-beta.16",
+    "@nocobase/app-plugin-mail": "^1.0.0-beta.19",
+    "@nocobase/app-plugin-notification": "^2.0.0-beta.3",
+    "@nocobase/app-plugin-notification-in-app": "^2.0.0-beta.1",
+    "@nocobase/app-plugin-notification-providers": "^1.0.0-beta.17",
+    "@nocobase/app-plugin-scheduler": "^1.0.0-beta.22",
+    "@nocobase/app-plugin-users": "^2.0.0-beta.12",
+    "@nocobase/app-server": "^4.0.0-beta.0",
     "@nocobase/config": "^0.1.0-beta.3",
-    "@nocobase/db": "^1.0.0-beta.23",
+    "@nocobase/db": "^1.0.0-beta.24",
     "@nocobase/db-sqlite": "^0.1.0-beta.6",
     "@nocobase/service-provider": "^0.0.2-beta.2",
     "@nocobase/snowflake": "^1.0.0-beta.4",
-    "@nocobase/app-plugin-authz-default-access": "^1.0.0-beta.17",
-    "@nocobase/app-plugin-authz-sharing-rules": "^1.0.0-beta.16",
-    "@nocobase/app-plugin-authz-restriction-rules": "^1.0.0-beta.15",
-    "@nocobase/authorization": "^1.0.0-beta.15",
-    "@nocobase/queue": "^0.1.0-beta.9",
-    "@nocobase/jobs": "^0.1.0-beta.4",
-    "@nocobase/lifecycle": "^0.1.0-beta.3",
+    "@nocobase/app-plugin-authz-default-access": "^1.0.0-beta.18",
+    "@nocobase/app-plugin-authz-sharing-rules": "^1.0.0-beta.17",
+    "@nocobase/app-plugin-authz-restriction-rules": "^1.0.0-beta.16",
+    "@nocobase/authorization": "^1.0.0-beta.16",
+    "@nocobase/queue": "^1.0.0-beta.10",
+    "@nocobase/jobs": "^1.0.0-beta.5",
+    "@nocobase/lifecycle": "^0.1.0-beta.4",
     "@nocobase/i18n": "^2.0.0-beta.1",
     "@nocobase/caching": "^0.1.0-beta.3",
     "@nocobase/repository-input": "^0.1.0-beta.3",
-    "@nocobase/app-cli": "^1.0.0-beta.30",
-    "@nocobase/realtime": "^0.1.0-beta.3"
+    "@nocobase/app-cli": "^1.0.0-beta.31",
+    "@nocobase/realtime": "^1.0.0-beta.0"
   },
   "description": "NocoBase 3 application template with the standard product capabilities.",
   "imports": {

package/server/app.ts

@@ -1,4 +1,3 @@
-import { MailerProvider } from '@nocobase/app-server/mailer';
 import type { Application } from '@nocobase/app-server/application';
 import { DatabaseProvider } from '@nocobase/app-server/database';
 import { I18nProvider, i18nHttpMiddleware } from '@nocobase/app-server/i18n';
@@ -34,7 +33,6 @@ export function createApp(runtime: AppRuntimeContext): Application {
   app.addServiceProvider(SecretsProvider);
   app.addServiceProvider(SessionProvider);
   app.addServiceProvider(DriveProvider);
-  app.addServiceProvider(MailerProvider);
   app.addServiceProvider(QueueServiceProvider, {
     nodeEnv: runtime.env.NODE_ENV,
   });

package/server/config/auth.ts

@@ -12,6 +12,8 @@ import { bearer, deviceAuthorization, username } from 'better-auth/plugins';
  */
 const CLI_CLIENT_IDS: readonly string[] = ['nocobase-cli'];
 
+// defineAuthConfig supplies AUTH_EMAIL_* mappings and validates the private auth.email sender.
+// Automatic recovery requires passwordReset.enabled: true; leave the switch absent for custom callback compatibility.
 const auth: AppConfigFactory<AuthConfig> = defineAuthConfig({
   defaults: {
     plugins: [

package/server/config/concurrency.ts

@@ -0,0 +1,3 @@
+import { defineConcurrencyConfig } from '@nocobase/app-plugin-concurrency/config';
+
+export default defineConcurrencyConfig();

package/server/config/index.ts

@@ -12,6 +12,7 @@ import server from './server.js';
 import spa from './spa.js';
 import logging from './logging.js';
 import drive from './drive.js';
+import concurrency from './concurrency.js';
 import queue from './queue.js';
 import jobs from './jobs.js';
 import scheduler from './scheduler.js';
@@ -35,6 +36,7 @@ const defaultConfigs: AppConfigFactory<{
   spa: ReturnType<typeof spa>;
   logging: ReturnType<typeof logging>;
   drive: ReturnType<typeof drive>;
+  concurrency: ReturnType<typeof concurrency>;
   queue: ReturnType<typeof queue>;
   jobs: ReturnType<typeof jobs>;
   scheduler: ReturnType<typeof scheduler>;
@@ -57,6 +59,7 @@ const defaultConfigs: AppConfigFactory<{
   spa,
   logging,
   drive,
+  concurrency,
   queue,
   jobs,
   scheduler,

package/server/config/jobs.ts

@@ -4,24 +4,12 @@ import {
 } from '@nocobase/app-server/config';
 import type { AppJobsConfig } from '@nocobase/app-server/jobs';
 
-/**
- * Configurations the jobs service can run on. None is the default: until `jobs.default` names one, executors
- * run on the built-in memory adapter, which serves one process and writes its state under storage/jobs when the
- * application stops, and which is reported at startup outside development. Name `memory` to keep that choice without
- * the report, or `redis` to run any number of instances with each firing executed once.
- */
+/** Single-process persistence. Distributed jobs require an explicitly registered backend plugin. */
 const jobs: AppConfigFactory<AppJobsConfig> = defineAppConfig(({ paths }) => ({
   memory: {
     adapter: 'memory',
     persistence: { path: paths.storage('jobs') },
   },
-  redis: {
-    adapter: 'redis',
-    connection: { host: '127.0.0.1', port: 6379, db: 0 },
-    // Every firing leaves a finished job behind; keep the history bounded.
-    removeOnComplete: { count: 1000 },
-    removeOnFail: { age: 604_800 },
-  },
 }));
 
 export default jobs;

package/server/config/notification.ts

@@ -1,4 +1,4 @@
-import { defineMailChannelsConfig } from '@nocobase/app-server/mailer';
+import { defineMailChannelsConfig } from '@nocobase/app-plugin-notification-providers/config';
 import { type AppConfigFactory } from '@nocobase/app-server/config';
 import type { NotificationConfig } from '@nocobase/app-plugin-notification/server';
 

package/server/config/queue.ts

@@ -8,7 +8,7 @@ import type { AppQueueConfig } from '@nocobase/app-server/queue';
  * Configurations queues can run on. None is the default: until `queue.default` names one, queues run on the
  * built-in memory configuration, which serves one process and writes its pending jobs under storage/queue when the
  * application stops, and which is reported at startup outside development. Name `memory` to keep that choice without
- * the report, or `redis` to share queues across instances.
+ * the report. Shared Redis queues require explicit registration of @nocobase/app-plugin-queue-redis/server.
  */
 const queue: AppConfigFactory<AppQueueConfig> = defineAppConfig(
   ({ paths }) => ({
@@ -16,12 +16,6 @@ const queue: AppConfigFactory<AppQueueConfig> = defineAppConfig(
       adapter: 'inMemory',
       persistence: { path: paths.storage('queue') },
     },
-    redis: {
-      adapter: 'redis',
-      connection: { host: '127.0.0.1', port: 6379, db: 0 },
-      removeOnComplete: { count: 1000 },
-      removeOnFail: { age: 604_800 },
-    },
   }),
 );
 

package/server/plugins.ts

@@ -1,3 +1,4 @@
+import concurrency from '@nocobase/app-plugin-concurrency/server';
 import foundation from '@nocobase/app-plugin-foundation/server';
 import defaultAccess from '@nocobase/app-plugin-authz-default-access/server';
 import sharingRules from '@nocobase/app-plugin-authz-sharing-rules/server';
@@ -20,6 +21,7 @@ import file from '@nocobase/app-plugin-file/server';
 import mail from '@nocobase/app-plugin-mail/server';
 
 const serverPlugins: AppServerPlugins = defineServerPlugins([
+  concurrency,
   authentication,
   authorization,
   defaultAccess,

package/tests/client/data-table.test.tsx

@@ -114,14 +114,19 @@ describe('standard DataTable', () => {
     expect(screen.getByText('Page 4 of 6')).toBeVisible();
     expect(screen.getByText('row-0')).toBeVisible();
   });
-  it('keeps empty-state and paging controls localized in Chinese', async () => {
+  it('localizes successful emptiness and keeps the table headers without paging controls', async () => {
     await renderWithApp(
       <DataTable columns={columns} data={[]} showSelectedCount={false} />,
       { namespace, namespaces, locale: 'zh-CN' },
     );
-    expect(screen.getByText(zhCN.dataTable.noResults)).toBeVisible();
+    expect(screen.getByText(zhCN.listFeedback.empty)).toBeVisible();
+    expect(screen.getByRole('table')).toBeVisible();
+    expect(screen.getByRole('columnheader', { name: 'ID' })).toBeVisible();
     expect(
-      screen.getByRole('button', { name: zhCN.dataTable.nextPage }),
-    ).toBeDisabled();
+      screen.queryByText(zhCN.dataTable.noResults),
+    ).not.toBeInTheDocument();
+    expect(
+      screen.queryByRole('button', { name: zhCN.dataTable.nextPage }),
+    ).not.toBeInTheDocument();
   });
 });

package/tests/client/default-access.test.tsx

@@ -343,7 +343,7 @@ it('keeps failed deletion in its confirmation and deletes only after explicit co
   expect(screen.getByRole('alertdialog')).toBeVisible();
   expect(screen.queryByText('Private server detail')).not.toBeInTheDocument();
   await user.click(screen.getByRole('button', { name: 'Delete', exact: true }));
-  await screen.findByText(enUS.settings.defaultAccess.empty);
+  await screen.findByText(enUS.listFeedback.empty);
   expect(deletes).toBe(2);
 });
 it('retains the create draft when the server rejects a duplicate and shows a contextual error', async () => {
@@ -485,6 +485,46 @@ it('refuses deleting a changed rule and refreshes the list for explicit re-confi
   expect(screen.queryByRole('alertdialog')).not.toBeInTheDocument();
 });
 
+it('keeps one authorized create entry in the header for an empty list', async () => {
+  await renderWithApp(tree(), {
+    route: '/default-access',
+    namespace,
+    namespaces,
+    services,
+    fetch: answerApi(({ path }) =>
+      path === 'authorization/permissions'
+        ? { data: { unrestricted: true, permissions: [] } }
+        : path.endsWith('/options')
+          ? { data: catalog }
+          : { data: [] },
+    ),
+  });
+  const label = enUS.settings.defaultAccess.new;
+  const create = await screen.findByRole('button', { name: label });
+  expect(create).toHaveAttribute('href', '/default-access/create');
+  expect(screen.getAllByRole('button', { name: label })).toHaveLength(1);
+});
+
+it('hides the create entry for a read-only empty list', async () => {
+  await renderWithApp(tree(), {
+    route: '/default-access',
+    namespace,
+    namespaces,
+    services,
+    fetch: answerApi(({ path }) =>
+      path === 'authorization/permissions'
+        ? { data: { unrestricted: false, permissions: [] } }
+        : path.endsWith('/options')
+          ? { data: catalog }
+          : { data: [] },
+    ),
+  });
+  const label = enUS.settings.defaultAccess.new;
+  expect(await screen.findByText(enUS.listFeedback.empty)).toBeVisible();
+  expect(screen.queryByRole('link', { name: label })).not.toBeInTheDocument();
+  expect(screen.queryByRole('button', { name: label })).not.toBeInTheDocument();
+});
+
 it('disables New rule with a reason when every available resource is already configured', async () => {
   await renderWithApp(tree(), {
     route: '/default-access',
@@ -733,16 +773,14 @@ it.each(['transport', 'server'])(
     await userEvent.click(
       screen.getByRole('button', { name: 'Delete', exact: true }),
     );
-    expect(
-      await screen.findByText(enUS.settings.defaultAccess.empty),
-    ).toBeVisible();
+    expect(await screen.findByText(enUS.listFeedback.empty)).toBeVisible();
     expect(screen.getByRole('alertdialog')).toBeVisible();
     expect(screen.getByText(enUS.settings.failed)).toBeVisible();
     await userEvent.click(
       screen.getByRole('button', { name: 'Cancel', exact: true }),
     );
     await waitFor(() =>
-      expect(screen.getByText(enUS.settings.defaultAccess.empty)).toBeVisible(),
+      expect(screen.getByText(enUS.listFeedback.empty)).toBeVisible(),
     );
     expect(writes).toBe(1);
   },