From d1b9feab824af9fe294691495e8cc589f612a749 Mon Sep 17 00:00:00 2001
From: SowinskiBraeden <braeden@sowinski.dev>
Date: Sat, 27 Jun 2026 10:42:11 -0700
Subject: [PATCH] Remove ledger access from viewer role

---
 config.py                       |  2 +-
 routes/leagues.py               | 23 +++++++++++++----------
 templates/_league_sidebar.html  |  2 +-
 templates/_league_subnav.html   |  2 +-
 templates/league_dashboard.html |  2 ++
 templates/leagues_index.html    |  2 ++
 6 files changed, 20 insertions(+), 13 deletions(-)

diff --git a/config.py b/config.py
index 0608d1c..892794d 100644
--- a/config.py
+++ b/config.py
@@ -9,7 +9,7 @@ DATA_PATH = BASE_DIR / "data" / "entries.csv"
 DEFAULT_DATABASE_URL = f"sqlite:///{BASE_DIR / 'data' / 'boker-dev.sqlite3'}"
 
 ELIGIBLE_MIN_SESSIONS = 3
-APP_VERSION = "2.5.6"
+APP_VERSION = "2.5.7"
 
 
 def load_local_env(env_path: Path) -> None:
diff --git a/routes/leagues.py b/routes/leagues.py
index 9aee964..5e85dae 100644
--- a/routes/leagues.py
+++ b/routes/leagues.py
@@ -227,6 +227,7 @@ def dashboard(league_ref: str):
     league, resp = get_league_with_visibility_gate(league_ref)
     if resp:
         return resp
+    can_manage = user_has_league_role(current_user_id() or "", league.id, {"owner", "manager"})
     is_owner = user_has_league_role(current_user_id() or "", league.id, {"owner"})
 
     all_sessions = build_session_summaries(list_event_rows_for_league(league.id))
@@ -275,6 +276,7 @@ def dashboard(league_ref: str):
         "league_dashboard.html",
         league=league,
         counts=league_counts(league.id),
+        can_manage=can_manage,
         is_owner=is_owner,
         cash_stats=cash_stats,
     )
@@ -310,6 +312,7 @@ def leaderboard(league_ref: str):
     league, resp = get_league_with_visibility_gate(league_ref)
     if resp:
         return resp
+    can_manage = user_has_league_role(current_user_id() or "", league.id, {"owner", "manager"})
     is_owner = user_has_league_role(current_user_id() or "", league.id, {"owner"})
     eligible_min_sessions = league.eligible_min_sessions
     break_even_cents = league.break_even_cents
@@ -401,6 +404,7 @@ def leaderboard(league_ref: str):
             player.display_name: player.id
             for player in list_players_for_league(league.id)
         },
+        can_manage=can_manage,
         is_owner=is_owner,
     )
 
@@ -424,10 +428,7 @@ def ledger(league_ref: str):
         user_has_league_role,
     )
 
-    league = require_league(
-        league_ref,
-        {"owner", "manager"} if request.method == "POST" else {"owner", "manager", "viewer"},
-    )
+    league = require_league(league_ref, {"owner", "manager"})
     can_manage = user_has_league_role(current_user_id() or "", league.id, {"owner", "manager"})
     is_owner = user_has_league_role(current_user_id() or "", league.id, {"owner"})
 
@@ -953,10 +954,7 @@ def session_detail(league_ref: str, session_id: str):
         user_has_league_role,
     )
 
-    league = require_league(
-        league_ref,
-        {"owner", "manager"} if request.method == "POST" else {"owner", "manager", "viewer"},
-    )
+    league = require_league(league_ref, {"owner", "manager"})
     session = find_session_for_league(league.id, session_id)
     if session is None:
         abort(404)
@@ -1051,6 +1049,10 @@ def session_public_view(league_ref: str, session_id: str):
         if not user_has_league_role(user_id, league.id, {"owner", "manager", "viewer"}):
             abort(403)
 
+    user_id = current_user_id() or ""
+    can_manage = user_has_league_role(user_id, league.id, {"owner", "manager"})
+    is_owner = user_has_league_role(user_id, league.id, {"owner"})
+
     session = find_session_for_league(league.id, session_id)
     if session is None:
         abort(404)
@@ -1087,7 +1089,8 @@ def session_public_view(league_ref: str, session_id: str):
         session_label=session_label,
         prev_session_id=ref_to_db_id.get(prev_summary.session_id) if prev_summary else None,
         next_session_id=ref_to_db_id.get(next_summary.session_id) if next_summary else None,
-        is_owner=False,
+        can_manage=can_manage,
+        is_owner=is_owner,
     )
 
 
@@ -1324,7 +1327,7 @@ def export_ledger_csv(league_ref: str):
     from ledger_repositories import list_event_rows_for_league
     from storage import CSV_HEADERS
 
-    league = require_league(league_ref, {"owner", "manager", "viewer"})
+    league = require_league(league_ref, {"owner", "manager"})
     rows = list_event_rows_for_league(league.id)
 
     buf = io.StringIO()
diff --git a/templates/_league_sidebar.html b/templates/_league_sidebar.html
index 4fbaef3..81bfec6 100644
--- a/templates/_league_sidebar.html
+++ b/templates/_league_sidebar.html
@@ -51,7 +51,7 @@
             <span>Leaderboard</span>
         </a>
 
-        {% if is_logged_in %}
+        {% if can_manage is defined and can_manage %}
         <a class="sidebar__link {{ 'is-active' if request.endpoint == 'leagues.ledger' }}"
            href="{{ url_for('leagues.ledger', league_ref=league.url_ref) }}">
             <svg viewBox="0 0 16 16" fill="none" aria-hidden="true">
diff --git a/templates/_league_subnav.html b/templates/_league_subnav.html
index 38380b0..44cc7ec 100644
--- a/templates/_league_subnav.html
+++ b/templates/_league_subnav.html
@@ -7,7 +7,7 @@
             <a class="subnav__link {{ 'is-active' if request.endpoint in ('leagues.sessions', 'leagues.session_detail') }}" href="{{ url_for('leagues.sessions', league_ref=league.url_ref) }}">Sessions</a>
             <a class="subnav__link {{ 'is-active' if request.endpoint in ('leagues.players', 'leagues.player_detail') }}" href="{{ url_for('leagues.players', league_ref=league.url_ref) }}">Players</a>
             <a class="subnav__link {{ 'is-active' if request.endpoint == 'leagues.leaderboard' }}" href="{{ url_for('leagues.leaderboard', league_ref=league.url_ref) }}">Leaderboard</a>
-            {% if is_logged_in %}
+            {% if can_manage is defined and can_manage %}
             <a class="subnav__link {{ 'is-active' if request.endpoint == 'leagues.ledger' }}" href="{{ url_for('leagues.ledger', league_ref=league.url_ref) }}">Ledger</a>
             {% endif %}
             {% if is_owner is defined and is_owner %}
diff --git a/templates/league_dashboard.html b/templates/league_dashboard.html
index d787814..a541ce8 100644
--- a/templates/league_dashboard.html
+++ b/templates/league_dashboard.html
@@ -307,6 +307,7 @@
         <span class="db-nav-tile__arrow">→</span>
     </a>
 
+    {% if can_manage %}
     <a class="db-nav-tile db-nav-tile--ledger" href="{{ url_for('leagues.ledger', league_ref=league.url_ref) }}">
         <div class="db-nav-tile__icon">
             <svg width="22" height="22" viewBox="0 0 24 24" fill="none" aria-hidden="true">
@@ -322,6 +323,7 @@
         </div>
         <span class="db-nav-tile__arrow">→</span>
     </a>
+    {% endif %}
 
 </div>
 
diff --git a/templates/leagues_index.html b/templates/leagues_index.html
index c0940a8..f39ff4b 100644
--- a/templates/leagues_index.html
+++ b/templates/leagues_index.html
@@ -111,7 +111,9 @@
                     <a class="btn btn--primary btn--sm" href="{{ url_for('leagues.dashboard', league_ref=league.url_ref) }}">Open league</a>
                     <a class="li-action-link" href="{{ url_for('leagues.sessions', league_ref=league.url_ref) }}">Sessions</a>
                     <a class="li-action-link" href="{{ url_for('leagues.leaderboard', league_ref=league.url_ref) }}">Leaderboard</a>
+                    {% if membership.role in ('owner', 'manager') %}
                     <a class="li-action-link" href="{{ url_for('leagues.ledger', league_ref=league.url_ref) }}">Ledger</a>
+                    {% endif %}
                 </div>
             </div>
         </div>