feat(repo): hide write UI for users without push access

Fetch the viewer's push permission via GET /repos/{owner}/{repo} when
entering a repo and gate every write affordance behind it: edit and
image-upload buttons in StackedNote, new-fleeting-note and YouTube
buttons in FleetingNotes, and interactive checkboxes in TodoNotes
(rendered disabled when read-only). Anonymous viewers get the same
treatment because the permissions field is absent without auth, which
collapses to canPush = false.

Previously every write button was visible regardless of role, so
read-role collaborators and anonymous viewers could enter edit mode and
type before the save failed with 401/403.

src/components/StackedNote.vue

@@ -100,6 +100,7 @@ useTitleNotes(repo)
 
 const store = useUserRepoStore()
 const hasBacklinks = computed(() => store.userSettings?.backlink)
+const canPush = computed(() => store.canPush)
 
 const { displayNoteOverlay } = useNoteOverlay(className.value, index)
 const displayedTitle = computed(() => filenameToNoteTitle(props.title ?? ""))
@@ -303,7 +304,7 @@ const onBadgeClick = async () => {
           class="action"
         />
         <button
-          v-if="isMarkdown"
+          v-if="isMarkdown && canPush"
           class="action button is-text is-light"
           :class="{ 'is-link': mode === 'edit' }"
           :style="mode === 'edit' ? 'color: var(--color-primary)' : ''"
@@ -353,7 +354,7 @@ const onBadgeClick = async () => {
           </svg>
         </button>
         <button
-          v-if="isMarkdown && mode === 'edit'"
+          v-if="isMarkdown && mode === 'edit' && canPush"
           class="action button is-text is-light"
           :title="isUploading ? 'Uploading…' : 'Upload image'"
           :disabled="isUploading"

src/hooks/useCheckboxCommit.hook.ts

@@ -35,7 +35,8 @@ export const useCheckboxCommit = ({
   initialContent,
   initialSha,
   containerSelector,
-  debounceMs = 1000
+  debounceMs = 1000,
+  enabled = true
 }: {
   user: string
   repo: string
@@ -44,6 +45,7 @@ export const useCheckboxCommit = ({
   initialSha: Ref<string> | string
   containerSelector: string
   debounceMs?: number
+  enabled?: Ref<boolean> | boolean
 }) => {
   const { updateFile } = useGitHubContent({ user, repo })
 
@@ -91,6 +93,8 @@ export const useCheckboxCommit = ({
   const debouncedCommit = useDebounceFn(commitChanges, debounceMs)
 
   const handleCheckboxChange = (event: Event) => {
+    if (!toValue(enabled)) return
+
     const target = event.target as HTMLInputElement
 
     if (target.tagName !== "INPUT" || target.type !== "checkbox") {
@@ -128,8 +132,16 @@ export const useCheckboxCommit = ({
   const listenToCheckboxes = () => {
     removeListeners()
     const container = document.querySelector(containerSelector)
-    if (container) {
+    if (!container) return
+
+    if (toValue(enabled)) {
       container.addEventListener("change", handleCheckboxChange)
+    } else {
+      container
+        .querySelectorAll<HTMLInputElement>('input[type="checkbox"]')
+        .forEach((checkbox) => {
+          checkbox.disabled = true
+        })
     }
   }
 

src/modules/repo/services/repo.spec.ts

@@ -0,0 +1,56 @@
+import { beforeEach, describe, expect, it, vi } from "vitest"
+
+const { reposGet } = vi.hoisted(() => ({ reposGet: vi.fn() }))
+
+vi.mock("@/modules/repo/services/octo", () => ({
+  getOctokit: vi.fn().mockResolvedValue({
+    repos: { get: reposGet }
+  }),
+  runWithAuthRetry: vi.fn()
+}))
+
+vi.mock("@/hooks/useMarkdown.hook", () => ({
+  markdownBuilder: () => ({ render: (s: string) => s })
+}))
+
+vi.mock("@/modules/note/cache/prepareNoteCache", () => ({
+  prepareNoteCache: () => ({
+    getCachedNote: vi.fn().mockResolvedValue({ note: null }),
+    saveCacheNote: vi.fn()
+  })
+}))
+
+import { getRepoPermission } from "./repo"
+
+describe("getRepoPermission", () => {
+  beforeEach(() => {
+    reposGet.mockReset()
+  })
+
+  it("returns true when permissions.push is true", async () => {
+    reposGet.mockResolvedValue({
+      data: { permissions: { push: true } }
+    })
+    await expect(getRepoPermission("owner", "repo")).resolves.toBe(true)
+  })
+
+  it("returns false when permissions.push is false", async () => {
+    reposGet.mockResolvedValue({
+      data: { permissions: { push: false } }
+    })
+    await expect(getRepoPermission("owner", "repo")).resolves.toBe(false)
+  })
+
+  it("returns false when permissions is missing (anonymous request)", async () => {
+    reposGet.mockResolvedValue({
+      data: {}
+    })
+    await expect(getRepoPermission("owner", "repo")).resolves.toBe(false)
+  })
+
+  it("returns false when owner or repo is empty", async () => {
+    await expect(getRepoPermission("", "repo")).resolves.toBe(false)
+    await expect(getRepoPermission("owner", "")).resolves.toBe(false)
+    expect(reposGet).not.toHaveBeenCalled()
+  })
+})

src/modules/repo/services/repo.ts

@@ -4,6 +4,18 @@ import { RepoFile } from "@/modules/repo/interfaces/RepoFile"
 import { UserSettings } from "@/modules/repo/interfaces/UserSettings"
 import { getOctokit, runWithAuthRetry } from "@/modules/repo/services/octo"
 
+export const getRepoPermission = async (
+  owner: string,
+  repo: string
+): Promise<boolean> => {
+  if (!owner || !repo) {
+    return false
+  }
+  const octokit = await getOctokit()
+  const { data } = await octokit.repos.get({ owner, repo })
+  return data.permissions?.push ?? false
+}
+
 export const getFiles = async (
   owner: string,
   repo: string

src/modules/repo/store/userRepo.store.ts

@@ -10,6 +10,7 @@ import {
   getCachedMainReadme,
   getFiles,
   getMainReadme,
+  getRepoPermission,
   getUserSettingsContent
 } from "@/modules/repo/services/repo"
 import { refreshToken } from "@/modules/user/service/signIn"
@@ -24,6 +25,7 @@ interface State {
   userSettings?: UserSettings | null
   needToLogin: boolean
   loadError: RepoLoadError
+  canPush: boolean
   _requestId: number
 }
 
@@ -46,6 +48,7 @@ export const useUserRepoStore = defineStore("USER_REPO_STATE", {
     userSettings: undefined,
     needToLogin: false,
     loadError: null,
+    canPush: false,
     _requestId: 0
   }),
   actions: {
@@ -78,6 +81,7 @@ export const useUserRepoStore = defineStore("USER_REPO_STATE", {
       this.user = user
       this.repo = repo
       this.loadError = null
+      this.canPush = false
 
       let lsLayout: Partial<UserSettings> = {}
       try {
@@ -120,6 +124,17 @@ export const useUserRepoStore = defineStore("USER_REPO_STATE", {
 
       if (requestId !== this._requestId) return
 
+      getRepoPermission(user, repo)
+        .then((canPush) => {
+          if (requestId !== this._requestId) return
+          this.canPush = canPush
+        })
+        .catch((error) => {
+          if (requestId !== this._requestId) return
+          console.warn("getRepoPermission failed", error)
+          this.canPush = false
+        })
+
       getFiles(user, repo)
         .then(async (files) => {
           if (requestId !== this._requestId) return
@@ -261,6 +276,7 @@ export const useUserRepoStore = defineStore("USER_REPO_STATE", {
     resetFiles() {
       this.files = []
       this.readme = null
+      this.canPush = false
     },
     setFontFamily(fontFamily: string) {
       if (!this.userSettings) {

src/views/FleetingNotes.vue

@@ -9,6 +9,7 @@ import { useRouteQueryStackedNotes } from "@/hooks/useRouteQueryStackedNotes.hoo
 import { prepareNoteCache } from "@/modules/note/cache/prepareNoteCache"
 import EditNote from "@/modules/note/components/EditNote.vue"
 import { useFolderNotes } from "@/modules/note/hooks/useFolderNotes"
+import { useUserRepoStore } from "@/modules/repo/store/userRepo.store"
 import { encodeUTF8ToBase64 } from "@/utils/decodeBase64ToUTF8"
 import { confirmMessage, errorMessage } from "@/utils/notif"
 import { extractYouTubeId } from "@/utils/youtube"
@@ -76,6 +77,9 @@ const { createFile } = useGitHubContent({
 
 const hasTodayNote = computed(() => content.value.includes(today))
 
+const store = useUserRepoStore()
+const canPush = computed(() => store.canPush)
+
 watch(mode, async (newMode) => {
   if (newMode === "read" && newContent.value.trim() !== initialContent) {
     const content = `# ${new Date().toLocaleDateString()}\n\n${
@@ -114,13 +118,15 @@ watch(mode, async (newMode) => {
       <h3 class="subtitle">Inbox</h3>
       <div class="actions">
         <button
-          v-if="!hasTodayNote"
+          v-if="!hasTodayNote && canPush"
           class="btn btn-secondary"
           @click="toggleMode"
         >
           new fleeting note
         </button>
-        <button class="btn btn-outline" @click="handleYouTube">YouTube</button>
+        <button v-if="canPush" class="btn btn-outline" @click="handleYouTube">
+          YouTube
+        </button>
       </div>
 
       <div v-if="mode === 'edit'">

src/views/TodoNotes.vue

@@ -26,9 +26,10 @@ const todoNote = computed(() =>
 const sha = computed(() => todoNote.value?.sha ?? "")
 const path = computed(() => todoNote.value?.path)
 
+const canPush = computed(() => store.canPush)
+
 const { toHTML } = markdownBuilder(repo)
 
-// Setup checkbox commit handler
 const { pendingContent, syncContent, listenToCheckboxes, hasPendingChanges } =
   useCheckboxCommit({
     user: props.user,
@@ -37,7 +38,8 @@ const { pendingContent, syncContent, listenToCheckboxes, hasPendingChanges } =
     initialContent: "",
     initialSha: sha,
     containerSelector: ".todo-notes .note-display",
-    debounceMs: 1000
+    debounceMs: 1000,
+    enabled: canPush
   })
 
 // Render pending content to HTML for display
@@ -64,9 +66,9 @@ watch(
   { immediate: true }
 )
 
-// Setup checkbox listeners when content renders
+// Setup checkbox listeners when content renders or canPush changes
 watch(
-  renderedContent,
+  [renderedContent, canPush],
   async () => {
     await nextTick()
     listenToCheckboxes()