social: keep People with access readable in a read-only window

changelog.d/2446-sharing-read-access.fixed.md

@@ -0,0 +1 @@
+A Bot's Sharing card in a read-only window keeps **People with access** (who has this Bot, and its Auto-send state) and drops only its writes — no Revoke, no invite, no Share with a friend ([#2446](https://github.com/ThinkFlowLab/FlyBot/issues/2446)).

docs/subsystems/social.md

@@ -195,7 +195,7 @@ Settings → **Bot Social** lists friends and shares once the server is connecte
 ### Past rooms, unique titles, poll, and + (#129–#133)
 
 - Expired matching (`candidate` whose `expiresAt` has passed) and a peer leaving the last remote seat move the hosted room to **Past rooms** on the next poll (`rememberPastFace`, status `closed` / `left`). The local room stays so **Open** still works; **Leave** is not shown on those cards. Face-room names are `Face-to-face · Alice, Bob · 482913` (people plus the 6-digit code, or `Oct 16 21:40` when there is no code) so two rooms with the same people stay distinct. The literal `Face-to-face room` is not a fallback. The number printed there and on the waiting card is the six digits only (#1005): `faceWaitCode` and `shownFaceTitle` refuse a stored value that is not exactly six digits (`1234567` never reads as `123456`) and fall back to the code the owner typed, or to the creation time.
-- Ended-room state and titles (#304): when every other home's Bots have left an open room, this home marks it **Closed** (it did not leave; `faceSnapshotPast` → `closed` with `peersGone`) and then leaves it on Bot Social itself (`leaveFaceRoom({ status: 'closed' })`), so it stops polling the room and the room-only identity is released (invariant 4). If that leave fails (timeout, 5xx), the next poll that still finds the room open on Bot Social tries it again. A room that drops off Bot Social's list without this home leaving is the same end (#1070): the hosted room is marked `closed` so the sidebar's active list drops it, and Past rooms keeps that one row (a `left` room stays Left). Its `endedAt` is the snapshot's `closed_at` when Bot Social sent one, so both homes show that time; otherwise the first time this home noticed. The owner who left keeps **Left**: `rememberPastFace` never turns a `left` row into `closed` when a later poll finds the room gone, and their room reads `You left this room.` while the others read `<Name> left the room. Room closed.` That status line is the one leave signal when the room closes (#1103): the shorter `<Name> left the room` is not also posted into the transcript. The number a room was joined by goes with every `upsertFace` (`joinCode`) and core keeps it on `room.face.joinCode`, so the title stays `Face-to-face · Alice, Bob · 482913` through polls, Leave and the end; Past rooms show that same title (people rebuilt from the row's members when it has them, the number or stored time kept; with neither, the creation time, never the joining deadline). A left or closed room's details are read-only: the status chip only, no Auto-send and no Leave. Past rows list everyone who was in the room (#304): `faceRoomTitle` takes the snapshot's members plus every participant the hosted room ever had (like the core title), and `viewHostedFace` for a closed or left room lists all participants, marking who had left `left: true` (Open on a dropped room seats only the others again); a row stored before this is refreshed from its hosted room. Each row shows its time (`data-flybot=face-time`): `endedAt`, set once by `rememberPastFace`, else the start (or creation) time; today reads `14:05`, an earlier day `Oct 19`, and the hover text has the full `Ended Oct 19 14:05`. The fold remembers whether it is open across a reload (`localStorage` `flybot.social.pastRoomsOpen`). A read-only window (the shell names it in `roster.readOnly`) keeps every read and drops every write (#2219): the section still polls `social/status` and still lists share requests, accept notices and past rooms, but draws no Dismiss, no Ask them to share a Bot, no Leave and no decision on a held send, offers none of the three Bot Social rows in the sidebar `+` menu, and `social/face-open` returns the stored past view (`readOnly: true`, name, status, members) instead of `upsertFace`-ing a local mirror, so reopening a past room creates no room; the room view's own head row draws the same chip-only head as a past room, with no Leave, no Auto-send switch and no invite (#2228), while a waiting room keeps its wait code and roster and drops its Leave and Enter chat; a local Bot's **Sharing** card and a local group's **Members** card draw only the window's reason, with no invite maker, no **Share with a friend**, no **People with access** and no **Create link** (#2418); a writable window behaves exactly as before.
+- Ended-room state and titles (#304): when every other home's Bots have left an open room, this home marks it **Closed** (it did not leave; `faceSnapshotPast` → `closed` with `peersGone`) and then leaves it on Bot Social itself (`leaveFaceRoom({ status: 'closed' })`), so it stops polling the room and the room-only identity is released (invariant 4). If that leave fails (timeout, 5xx), the next poll that still finds the room open on Bot Social tries it again. A room that drops off Bot Social's list without this home leaving is the same end (#1070): the hosted room is marked `closed` so the sidebar's active list drops it, and Past rooms keeps that one row (a `left` room stays Left). Its `endedAt` is the snapshot's `closed_at` when Bot Social sent one, so both homes show that time; otherwise the first time this home noticed. The owner who left keeps **Left**: `rememberPastFace` never turns a `left` row into `closed` when a later poll finds the room gone, and their room reads `You left this room.` while the others read `<Name> left the room. Room closed.` That status line is the one leave signal when the room closes (#1103): the shorter `<Name> left the room` is not also posted into the transcript. The number a room was joined by goes with every `upsertFace` (`joinCode`) and core keeps it on `room.face.joinCode`, so the title stays `Face-to-face · Alice, Bob · 482913` through polls, Leave and the end; Past rooms show that same title (people rebuilt from the row's members when it has them, the number or stored time kept; with neither, the creation time, never the joining deadline). A left or closed room's details are read-only: the status chip only, no Auto-send and no Leave. Past rows list everyone who was in the room (#304): `faceRoomTitle` takes the snapshot's members plus every participant the hosted room ever had (like the core title), and `viewHostedFace` for a closed or left room lists all participants, marking who had left `left: true` (Open on a dropped room seats only the others again); a row stored before this is refreshed from its hosted room. Each row shows its time (`data-flybot=face-time`): `endedAt`, set once by `rememberPastFace`, else the start (or creation) time; today reads `14:05`, an earlier day `Oct 19`, and the hover text has the full `Ended Oct 19 14:05`. The fold remembers whether it is open across a reload (`localStorage` `flybot.social.pastRoomsOpen`). A read-only window (the shell names it in `roster.readOnly`) keeps every read and drops every write (#2219): the section still polls `social/status` and still lists share requests, accept notices and past rooms, but draws no Dismiss, no Ask them to share a Bot, no Leave and no decision on a held send, offers none of the three Bot Social rows in the sidebar `+` menu, and `social/face-open` returns the stored past view (`readOnly: true`, name, status, members) instead of `upsertFace`-ing a local mirror, so reopening a past room creates no room; the room view's own head row draws the same chip-only head as a past room, with no Leave, no Auto-send switch and no invite (#2228), while a waiting room keeps its wait code and roster and drops its Leave and Enter chat; a local Bot's **Sharing** card draws the window's reason, no invite maker and no **Share with a friend**, and keeps **People with access** readable — the list of who has this Bot, and each person's Auto-send as a state line rather than a switch, with no Revoke — because `social/access` is a read the host allows (#2219, #2446), while a local group's **Members** card keeps no read of its own and draws only the reason with no **Create link** (#2418); a writable window behaves exactly as before.
 - The face-to-face join field for the room number starts empty with a light `6 digits` hint (normal letter spacing, 13px), not a `000000` that looks pre-filled (#173). A number that is not empty and not exactly six digits keeps **Join** disabled and shows **Enter 6 digits** under the field (#1052). Six digits clear that line and enable Join once a Bot is picked; an empty field shows nothing.
 - Round-3 polish (#173): **Accept invite** is no longer a separate **+** row; **Add friend** opens the single join panel for both a handle and an invite link or code. Escape closes the Add friend and Face-to-face panels, the `000000` code is a placeholder, Past rooms and friend rows use shorter copy, and Bot settings group invite and access under **Sharing** / **People with access**.
 - **Open** on a Past room calls `social/face-open` (`plugins/social/src/social.js`): it returns the existing local hosted session or recreates one from the saved room, so a peer home can open a room that already left Bot Social (#171). Titles come from `plugins/social/src/face-title.js`, with participant owners in stable handle order, so both homes show the same name (#172).

plugins/social/client.js

@@ -682,7 +682,7 @@
     function qrRsGenerator(degree) {
       let poly = [1]
       for (let i = 0; i < degree; i += 1) {
         const next = new Array(poly.length + 1).fill(0)
         for (let j = 0; j < poly.length; j += 1) {
           next[j] ^= poly[j]
           next[j + 1] ^= qrMul(poly[j], QR_GF_EXP[i])
@@ -3285,7 +3285,7 @@
       peopleAccessBot = botId
       actions.openSettings('bots', botId)
     }
-    function ManageAccess({ bot, onGrants }) {
+    function ManageAccess({ bot, onGrants, readOnly = false }) {
       const [view, setView] = useState(null)
       const [busy, setBusy] = useState('')
       const [error, setError] = useState('')
@@ -3342,6 +3342,9 @@
         finally { setBusy('') }
       }
       const grants = view?.grants ?? []
+      // #2446: People with access is a read, so a read-only window keeps the list and its
+      // Auto-send state, and only the two writes (Revoke, the Auto-send switch) go.
+      const note = readOnly ? 'One row per Bot. Default: nobody, Chief included.' : ACCESS_NOTE
       // One Auto-send switch per person, however many of their Bots are rows (#995).
       const autoShown = new Set()
       // A room the grant rows already named must not come back under "This room only" (#955).
@@ -3364,7 +3367,7 @@
       }
       return h('div', { className: 'fs fs-card', 'data-flybot': 'manage-access' },
         h('div', { className: 'fs-name' }, 'People with access'),
-        h('div', { className: 'fs-hint fs-face-note' }, ACCESS_NOTE),
+        h('div', { className: 'fs-hint fs-face-note' }, note),
         grants.length === 0 ? h('div', { className: 'fs-hint' }, 'Nobody has this Bot yet. Copy an invite link above and send it to a friend.') : null,
         grants.map((grant) => {
           const grantUsage = roomHint('use', grant.rooms)
@@ -3383,14 +3386,20 @@
               identity ? h('span', { className: 'fs-sub' }, identity) : null,
               identity && grantUsage ? ' · ' : null,
               grantUsage ? h('span', { className: 'fs-hint', title: grantUsage.title }, grantUsage.text) : null) : null),
-          showAuto ? h('label', { className: 'fs-auto fs-access-auto', 'data-flybot': 'access-auto-send', title: `${bot.name || 'This Bot'}'s replies to ${grant.person || grant.home} go out without asking you first.` },
-            h('input', {
-              type: 'checkbox', checked: grant.autoSend === true, disabled: Boolean(busy),
-              'aria-label': `Auto-send ${bot.name || 'this Bot'} → ${grant.person || grant.home}`,
-              onChange: e => { void toggleAutoSend(grant, e.target.checked) },
-            }),
-            'Auto-send') : null,
-          confirming
+          showAuto ? (readOnly
+            ? h('span', {
+              className: 'fs-hint fs-access-auto', 'data-flybot': 'access-auto-state',
+              title: `${bot.name || 'This Bot'}'s replies to ${grant.person || grant.home} go out without asking you first.`,
+            }, grant.autoSend === true ? 'Auto-send on' : 'Auto-send off')
+            : h('label', { className: 'fs-auto fs-access-auto', 'data-flybot': 'access-auto-send', title: `${bot.name || 'This Bot'}'s replies to ${grant.person || grant.home} go out without asking you first.` },
+              h('input', {
+                type: 'checkbox', checked: grant.autoSend === true, disabled: Boolean(busy),
+                'aria-label': `Auto-send ${bot.name || 'this Bot'} → ${grant.person || grant.home}`,
+                onChange: e => { void toggleAutoSend(grant, e.target.checked) },
+              }),
+              'Auto-send')) : null,
+          readOnly ? null
+            : confirming
             ? h('span', { className: 'fs-leave-ask fs-access-ask', 'data-flybot': 'revoke-grant-confirm' },
               h('span', { className: 'fs-hint' }, revokeAsk(grant)),
               h('button', {
@@ -3508,8 +3517,11 @@
       // read-only window can only have them refused, so it reads the reason instead.
       const locked = readOnlyReason(roster)
       if (locked) {
+        // #2446: social/access is registered `{ read: true }`, so People with access stays readable
+        // here; only its writes (Revoke, Auto-send) and the two invite entries go.
         return h('div', { className: 'fs-sharing', 'data-flybot': 'bot-social-details' },
-          h('div', { className: 'fs-hint', 'data-flybot': 'sharing-readonly', role: 'status' }, locked))
+          h('div', { className: 'fs-hint', 'data-flybot': 'sharing-readonly', role: 'status' }, locked),
+          h(ManageAccess, { bot, readOnly: true }))
       }
       return h('div', { className: 'fs-sharing', 'data-flybot': 'bot-social-details' },
         h(InviteToBot, { bot, revocable: granted > 0 }),