ngx-dynamic-entity 1.5.0 → 1.6.0

package/fesm2022/ngx-dynamic-entity.mjs

@@ -4140,12 +4140,19 @@ class DynamicFormComponent {
      */
     isFieldReadonly(field) {
         return (this.readonly ||
+            // `permissions.edit` gated the Save button and nothing else, so a role without edit
+            // rights received a fully editable form: it could type into every field, and only
+            // discovered the record was not theirs to change when no Save button appeared. The
+            // permission means the record may not be edited, so the fields say so.
+            !this.permissions.canEdit ||
             !!field.readonly ||
             this.readOnlyFields.includes(field.id) ||
             this.isFieldLocked(field));
     }
     toggleFieldLock(field) {
-        if (!field.criticalField || this.readonly)
+        // Unlocking is an edit. Without the permission check a viewer could open the lock on a
+        // critical field, which is the one control that exists to make editing deliberate.
+        if (!field.criticalField || this.readonly || !this.permissions.canEdit)
             return;
         const next = new Set(this.unlockedFields());
         if (next.has(field.id))
@@ -4854,6 +4861,7 @@ class DynamicRecordFormComponent {
     sectionSave = new EventEmitter();
     dynamicFormComp;
     rulesEvaluation = inject(RulesEvaluationService);
+    rbacService = inject(RbacService);
     host = inject(ElementRef);
     injector = inject(Injector);
     currentData = signal({}, ...(ngDevMode ? [{ debugName: "currentData" }] : /* istanbul ignore next */ []));
@@ -4883,9 +4891,21 @@ class DynamicRecordFormComponent {
     dismissInfoBanner(fieldId) {
         this.dismissed.set(new Set(this.dismissed()).add(fieldId));
     }
+    /**
+     * Whether the current roles may edit this record.
+     *
+     * `userRoles` was declared as an input here and then read by nothing at all — this
+     * component computed no permissions of any kind, so the record view was fully editable
+     * for every role while the plain form at least hid its Save button. Cached on the same
+     * terms as the sibling component: it depends only on `config` and `userRoles`.
+     */
+    permissionsCache = null;
+    get permissions() {
+        return (this.permissionsCache ??= this.rbacService.getPermissions(this.config, this.userRoles));
+    }
     /** True when nothing in the record may be edited. */
     get recordReadOnly() {
-        return this.readonly || this.isReadOnly;
+        return this.readonly || this.isReadOnly || !this.permissions.canEdit;
     }
     // ─── Inline array-row editing ───────────────────────────────────────────────
     /**
@@ -5097,6 +5117,11 @@ class DynamicRecordFormComponent {
      * after the first keystroke.
      */
     ngOnChanges(changes) {
+        // Permissions depend on these two and nothing else; a stale cache would keep a record
+        // editable after a role switch.
+        if (changes['config'] || changes['userRoles']) {
+            this.permissionsCache = null;
+        }
         if (changes['initialData'] || changes['config']) {
             this.originalBaseline.set({ ...(this.initialData ?? {}) });
             this.currentData.set({ ...(this.initialData ?? {}) });