Conpherence - Implement edit rules for rooms

Summary: Fixes T7586. If you can't edit a room, the pertinent UI is greyed out. One exception is the title of the room in the full viewer; this crumb is not disabled as it would be hard to read. Otherwise though, everything is disabled nicely. Test Plan: tried to add participants when I wasn't allowed to and got an error. added participants otherwise okay. tried to edit title when i wasn't allowed and got an error. otherwise okay. left conpherence threads / rooms successfully. Reviewers: epriestley, chad Reviewed By: epriestley Subscribers: Korvin, epriestley Maniphest Tasks: T7586 Differential Revision: https://secure.phabricator.com/D12161
2024-12-18 19:40:55 +01:00 · 2015-03-25 11:48:22 -07:00 · 2015-03-25 11:48:22 -07:00 · 42a0229a52
commit 42a0229a52
parent 1fd163d097
15 changed files with 203 additions and 82 deletions
--- a/resources/celerity/map.php
+++ b/resources/celerity/map.php
@ -7,10 +7,10 @@
 */
 return array(
  'names' => array(
-    'core.pkg.css' => '404f1f98',
+    'core.pkg.css' => 'ab12d75f',
    'core.pkg.js' => '75599122',
    'darkconsole.pkg.js' => '8ab24e01',
-    'differential.pkg.css' => '865a69a4',
+    'differential.pkg.css' => '217276e8',
    'differential.pkg.js' => 'e324301d',
    'diffusion.pkg.css' => '591664fa',
    'diffusion.pkg.js' => 'bfc0737b',
@ -49,13 +49,13 @@ return array(
    'rsrc/css/application/conpherence/message-pane.css' => 'e78e9d3c',
    'rsrc/css/application/conpherence/notification.css' => '04a6e10a',
    'rsrc/css/application/conpherence/update.css' => '1099a660',
-    'rsrc/css/application/conpherence/widget-pane.css' => '9199d87c',
+    'rsrc/css/application/conpherence/widget-pane.css' => '1979ee8c',
    'rsrc/css/application/contentsource/content-source-view.css' => '4b8b05d4',
    'rsrc/css/application/countdown/timer.css' => '86b7b0a0',
    'rsrc/css/application/dashboard/dashboard.css' => '17937d22',
    'rsrc/css/application/diff/inline-comment-summary.css' => 'eb5f8e8c',
    'rsrc/css/application/differential/add-comment.css' => 'c478bcaa',
-    'rsrc/css/application/differential/changeset-view.css' => '9d89c9ce',
+    'rsrc/css/application/differential/changeset-view.css' => 'c5d1e738',
    'rsrc/css/application/differential/core.css' => '7ac3cabc',
    'rsrc/css/application/differential/results-table.css' => '181aa9d9',
    'rsrc/css/application/differential/revision-comment.css' => '48186045',
@ -136,7 +136,7 @@ return array(
    'rsrc/css/phui/phui-image-mask.css' => '5a8b09c8',
    'rsrc/css/phui/phui-info-panel.css' => '27ea50a1',
    'rsrc/css/phui/phui-info-view.css' => 'c6f0aef8',
-    'rsrc/css/phui/phui-list.css' => '53deb25c',
+    'rsrc/css/phui/phui-list.css' => '2e25ebfb',
    'rsrc/css/phui/phui-object-box.css' => 'd68ce5dc',
    'rsrc/css/phui/phui-object-item-list-view.css' => '9db65899',
    'rsrc/css/phui/phui-pinboard-view.css' => '3dd4a269',
@ -352,12 +352,12 @@ return array(
    'rsrc/js/application/aphlict/behavior-aphlict-status.js' => 'ea681761',
    'rsrc/js/application/auth/behavior-persona-login.js' => '9414ff18',
    'rsrc/js/application/config/behavior-reorder-fields.js' => '14a827de',
-    'rsrc/js/application/conpherence/ConpherenceThreadManager.js' => '24561adb',
+    'rsrc/js/application/conpherence/ConpherenceThreadManager.js' => 'bb928342',
    'rsrc/js/application/conpherence/behavior-durable-column.js' => 'eedc463c',
-    'rsrc/js/application/conpherence/behavior-menu.js' => 'be9207ed',
+    'rsrc/js/application/conpherence/behavior-menu.js' => 'de5579b4',
    'rsrc/js/application/conpherence/behavior-pontificate.js' => '21ba5861',
    'rsrc/js/application/conpherence/behavior-quicksand-blacklist.js' => '7927a7d3',
-    'rsrc/js/application/conpherence/behavior-widget-pane.js' => '2c1cd7f5',
+    'rsrc/js/application/conpherence/behavior-widget-pane.js' => '1ec93bcf',
    'rsrc/js/application/countdown/timer.js' => 'e4cc26b3',
    'rsrc/js/application/dashboard/behavior-dashboard-async-panel.js' => '469c0d9e',
    'rsrc/js/application/dashboard/behavior-dashboard-move-panels.js' => '82439934',
@ -517,10 +517,10 @@ return array(
    'conpherence-menu-css' => '9b37a261',
    'conpherence-message-pane-css' => 'e78e9d3c',
    'conpherence-notification-css' => '04a6e10a',
-    'conpherence-thread-manager' => '24561adb',
+    'conpherence-thread-manager' => 'bb928342',
    'conpherence-update-css' => '1099a660',
-    'conpherence-widget-pane-css' => '9199d87c',
-    'differential-changeset-view-css' => '9d89c9ce',
+    'conpherence-widget-pane-css' => '1979ee8c',
+    'differential-changeset-view-css' => 'c5d1e738',
    'differential-core-view-css' => '7ac3cabc',
    'differential-inline-comment-editor' => 'b3412377',
    'differential-results-table-css' => '181aa9d9',
@ -556,9 +556,9 @@ return array(
    'javelin-behavior-boards-dropdown' => '0ec56e1d',
    'javelin-behavior-choose-control' => '6153c708',
    'javelin-behavior-config-reorder-fields' => '14a827de',
-    'javelin-behavior-conpherence-menu' => 'be9207ed',
+    'javelin-behavior-conpherence-menu' => 'de5579b4',
    'javelin-behavior-conpherence-pontificate' => '21ba5861',
-    'javelin-behavior-conpherence-widget-pane' => '2c1cd7f5',
+    'javelin-behavior-conpherence-widget-pane' => '1ec93bcf',
    'javelin-behavior-countdown-timer' => 'e4cc26b3',
    'javelin-behavior-dark-console' => '08883e8b',
    'javelin-behavior-dashboard-async-panel' => '469c0d9e',
@ -789,7 +789,7 @@ return array(
    'phui-image-mask-css' => '5a8b09c8',
    'phui-info-panel-css' => '27ea50a1',
    'phui-info-view-css' => 'c6f0aef8',
-    'phui-list-view-css' => '53deb25c',
+    'phui-list-view-css' => '2e25ebfb',
    'phui-object-box-css' => 'd68ce5dc',
    'phui-object-item-list-view-css' => '9db65899',
    'phui-pinboard-view-css' => '3dd4a269',
@ -947,6 +947,19 @@ return array(
      'javelin-dom',
      'javelin-reactor-dom',
    ),
+    '1ec93bcf' => array(
+      'javelin-behavior',
+      'javelin-dom',
+      'javelin-stratcom',
+      'javelin-workflow',
+      'javelin-util',
+      'phabricator-notification',
+      'javelin-behavior-device',
+      'phuix-dropdown-menu',
+      'phuix-action-list-view',
+      'phuix-action-view',
+      'conpherence-thread-manager',
+    ),
    '1feea462' => array(
      'javelin-install',
      'javelin-dom',
@ -980,16 +993,6 @@ return array(
      'javelin-workflow',
      'javelin-util',
    ),
-    '24561adb' => array(
-      'javelin-dom',
-      'javelin-util',
-      'javelin-stratcom',
-      'javelin-install',
-      'javelin-workflow',
-      'javelin-router',
-      'javelin-behavior-device',
-      'javelin-vector',
-    ),
    '2818f5ce' => array(
      'javelin-install',
      'javelin-util',
@ -1030,19 +1033,6 @@ return array(
      'javelin-stratcom',
      'javelin-dom',
    ),
-    '2c1cd7f5' => array(
-      'javelin-behavior',
-      'javelin-dom',
-      'javelin-stratcom',
-      'javelin-workflow',
-      'javelin-util',
-      'phabricator-notification',
-      'javelin-behavior-device',
-      'phuix-dropdown-menu',
-      'phuix-action-list-view',
-      'phuix-action-view',
-      'conpherence-thread-manager',
-    ),
    '2c426492' => array(
      'javelin-behavior',
      'javelin-dom',
@ -1681,6 +1671,16 @@ return array(
      'javelin-dom',
      'javelin-util',
    ),
+    'bb928342' => array(
+      'javelin-dom',
+      'javelin-util',
+      'javelin-stratcom',
+      'javelin-install',
+      'javelin-workflow',
+      'javelin-router',
+      'javelin-behavior-device',
+      'javelin-vector',
+    ),
    'bba9eedf' => array(
      'javelin-behavior',
      'javelin-stratcom',
@ -1726,18 +1726,6 @@ return array(
      'javelin-util',
      'phabricator-shaped-request',
    ),
-    'be9207ed' => array(
-      'javelin-behavior',
-      'javelin-dom',
-      'javelin-util',
-      'javelin-stratcom',
-      'javelin-workflow',
-      'javelin-behavior-device',
-      'javelin-history',
-      'javelin-vector',
-      'phabricator-shaped-request',
-      'conpherence-thread-manager',
-    ),
    'c1700f6f' => array(
      'javelin-install',
      'javelin-util',
@ -1812,6 +1800,18 @@ return array(
      'javelin-typeahead-ondemand-source',
      'javelin-dom',
    ),
+    'de5579b4' => array(
+      'javelin-behavior',
+      'javelin-dom',
+      'javelin-util',
+      'javelin-stratcom',
+      'javelin-workflow',
+      'javelin-behavior-device',
+      'javelin-history',
+      'javelin-vector',
+      'phabricator-shaped-request',
+      'conpherence-thread-manager',
+    ),
    'e10f8e18' => array(
      'javelin-behavior',
      'javelin-dom',
--- a/src/applications/conpherence/controller/ConpherenceColumnViewController.php
+++ b/src/applications/conpherence/controller/ConpherenceColumnViewController.php
@ -84,7 +84,12 @@ final class ConpherenceColumnViewController extends
      'content' => hsprintf('%s', $durable_column),
      'threadID' => $conpherence_id,
      'threadPHID' => $conpherence_phid,
-      'latestTransactionID' => $latest_transaction_id,);
+      'latestTransactionID' => $latest_transaction_id,
+      'canEdit' => PhabricatorPolicyFilter::hasCapability(
+        $user,
+        $conpherence,
+        PhabricatorPolicyCapability::CAN_EDIT),
+    );

    return id(new AphrontAjaxResponse())->setContent($response);
  }
--- a/src/applications/conpherence/controller/ConpherenceListController.php
+++ b/src/applications/conpherence/controller/ConpherenceListController.php
@ -152,6 +152,7 @@ final class ConpherenceListController extends ConpherenceController {
      case self::UNSELECTED_MODE:
      default:
        $layout = id(new ConpherenceLayoutView())
+          ->setUser($user)
          ->setBaseURI($this->getApplicationURI())
          ->setThreadView($thread_view)
          ->setRole('list');
--- a/src/applications/conpherence/controller/ConpherenceUpdateController.php
+++ b/src/applications/conpherence/controller/ConpherenceUpdateController.php
@ -3,35 +3,37 @@
 final class ConpherenceUpdateController
  extends ConpherenceController {

-  private $conpherenceID;
-
-  public function setConpherenceID($conpherence_id) {
-    $this->conpherenceID = $conpherence_id;
-    return $this;
-  }
-  public function getConpherenceID() {
-    return $this->conpherenceID;
-  }
-  public function willProcessRequest(array $data) {
-    $this->setConpherenceID(idx($data, 'id'));
-  }
-
-  public function processRequest() {
-    $request = $this->getRequest();
+  public function handleRequest(AphrontRequest $request) {
    $user = $request->getUser();
-    $conpherence_id = $this->getConpherenceID();
+    $conpherence_id = $request->getURIData('id');
    if (!$conpherence_id) {
      return new Aphront404Response();
    }

+    $needed_capabilities = array(PhabricatorPolicyCapability::CAN_VIEW);
+    $action = $request->getStr('action', ConpherenceUpdateActions::METADATA);
+    switch ($action) {
+      case ConpherenceUpdateActions::REMOVE_PERSON:
+        $person_phid = $request->getStr('remove_person');
+        if ($person_phid != $user->getPHID()) {
+          $needed_capabilities[] = PhabricatorPolicyCapability::CAN_EDIT;
+        }
+        break;
+      case ConpherenceUpdateActions::ADD_PERSON:
+      case ConpherenceUpdateActions::METADATA:
+        $needed_capabilities[] = PhabricatorPolicyCapability::CAN_EDIT;
+        break;
+      case ConpherenceUpdateActions::JOIN_ROOM:
+        $needed_capabilities[] = PhabricatorPolicyCapability::CAN_JOIN;
+        break;
+    }
    $conpherence = id(new ConpherenceThreadQuery())
      ->setViewer($user)
      ->withIDs(array($conpherence_id))
      ->needFilePHIDs(true)
+      ->requireCapabilities($needed_capabilities)
      ->executeOne();

-    $action = $request->getStr('action', ConpherenceUpdateActions::METADATA);
-
    $latest_transaction_id = null;
    $response_mode = $request->isAjax() ? 'ajax' : 'redirect';
    $error_view = null;
@ -54,10 +56,6 @@ final class ConpherenceUpdateController
          $draft->replaceOrDelete();
          return new AphrontAjaxResponse();
        case ConpherenceUpdateActions::JOIN_ROOM:
-          PhabricatorPolicyFilter::requireCapability(
-            $user,
-            $conpherence,
-            PhabricatorPolicyCapability::CAN_JOIN);
          $xactions[] = id(new ConpherenceTransaction())
            ->setTransactionType(
              ConpherenceTransactionType::TYPE_PARTICIPANTS)
@ -257,14 +255,19 @@ final class ConpherenceUpdateController
    $user = $request->getUser();
    $remove_person = $request->getStr('remove_person');
    $participants = $conpherence->getParticipants();
+    if ($conpherence->getIsRoom()) {
      $message = pht(
-      'Are you sure you want to remove yourself from this conpherence? ');
+        'Are you sure you want to remove yourself from this room?');
+    } else {
+      $message = pht(
+        'Are you sure you want to remove yourself from this thread?');
      if (count($participants) == 1) {
        $message .= pht(
-        'The conpherence will be inaccessible forever and ever.');
+          'The thread will be inaccessible forever and ever.');
      } else {
        $message .= pht(
-        'Someone else in the conpherence can add you back later.');
+          'Someone else in the thread can add you back later.');
+      }
    }
    $body = phutil_tag(
      'p',
--- a/src/applications/conpherence/controller/ConpherenceViewController.php
+++ b/src/applications/conpherence/controller/ConpherenceViewController.php
@ -63,10 +63,15 @@ final class ConpherenceViewController extends
      $content['threadID'] = $conpherence->getID();
      $content['threadPHID'] = $conpherence->getPHID();
      $content['latestTransactionID'] = $data['latest_transaction_id'];
+      $content['canEdit'] = PhabricatorPolicyFilter::hasCapability(
+        $user,
+        $conpherence,
+        PhabricatorPolicyCapability::CAN_EDIT);
      return id(new AphrontAjaxResponse())->setContent($content);
    }

    $layout = id(new ConpherenceLayoutView())
+      ->setUser($user)
      ->setBaseURI($this->getApplicationURI())
      ->setThread($conpherence)
      ->setHeader($header)
--- a/src/applications/conpherence/editor/ConpherenceEditor.php
+++ b/src/applications/conpherence/editor/ConpherenceEditor.php
@ -369,6 +369,51 @@ final class ConpherenceEditor extends PhabricatorApplicationTransactionEditor {
    return $xactions;
  }

+  protected function requireCapabilities(
+    PhabricatorLiskDAO $object,
+    PhabricatorApplicationTransaction $xaction) {
+
+    parent::requireCapabilities($object, $xaction);
+
+    switch ($xaction->getTransactionType()) {
+      case ConpherenceTransactionType::TYPE_PARTICIPANTS:
+        $old_map = array_fuse($xaction->getOldValue());
+        $new_map = array_fuse($xaction->getNewValue());
+
+        $add = array_keys(array_diff_key($new_map, $old_map));
+        $rem = array_keys(array_diff_key($old_map, $new_map));
+
+        $actor_phid = $this->requireActor()->getPHID();
+
+        $is_join = (($add === array($actor_phid)) && !$rem);
+        $is_leave = (($rem === array($actor_phid)) && !$add);
+
+        if ($is_join) {
+          // You need CAN_JOIN to join a thread / room.
+          PhabricatorPolicyFilter::requireCapability(
+            $this->requireActor(),
+            $object,
+            PhabricatorPolicyCapability::CAN_JOIN);
+        } else if ($is_leave) {
+          // You don't need any capabilities to leave a conpherence thread.
+        } else {
+          // You need CAN_EDIT to change participants other than yourself.
+          PhabricatorPolicyFilter::requireCapability(
+            $this->requireActor(),
+            $object,
+            PhabricatorPolicyCapability::CAN_EDIT);
+        }
+        break;
+      case ConpherenceTransactionType::TYPE_FILES:
+      case ConpherenceTransactionType::TYPE_TITLE:
+        PhabricatorPolicyFilter::requireCapability(
+          $this->requireActor(),
+          $object,
+          PhabricatorPolicyCapability::CAN_EDIT);
+        break;
+    }
+  }
+
  protected function mergeTransactions(
    PhabricatorApplicationTransaction $u,
    PhabricatorApplicationTransaction $v) {
@ -496,7 +541,7 @@ final class ConpherenceEditor extends PhabricatorApplicationTransactionEditor {

    switch ($type) {
      case ConpherenceTransactionType::TYPE_TITLE:
-        if (!$object->getIsRoom() && $this->getIsNewObject()) {
+        if (!$object->getIsRoom()) {
          continue;
        }
        $missing = $this->validateIsEmptyTextField(
--- a/src/applications/conpherence/storage/ConpherenceThread.php
+++ b/src/applications/conpherence/storage/ConpherenceThread.php
@ -266,7 +266,15 @@ final class ConpherenceThread extends ConpherenceDAO
  }

  public function describeAutomaticCapability($capability) {
+    if ($this->getIsRoom()) {
+      switch ($capability) {
+        case PhabricatorPolicyCapability::CAN_VIEW:
+          return pht('Participants in a room can always view it.');
+          break;
+      }
+    } else {
      return pht('Participants in a thread can always view and edit it.');
    }
+  }

 }
--- a/src/applications/conpherence/view/ConpherenceDurableColumnView.php
+++ b/src/applications/conpherence/view/ConpherenceDurableColumnView.php
@ -237,6 +237,7 @@ final class ConpherenceDurableColumnView extends AphrontTagView {
          ->setHref($action['href'])
          ->setName($action['name'])
          ->setIcon($action['icon'])
+          ->setDisabled($action['disabled'])
          ->addSigil('conpherence-durable-column-header-action')
          ->setMetadata(array(
            'action' => $action['key'],
@ -303,27 +304,41 @@ final class ConpherenceDurableColumnView extends AphrontTagView {
  }

  private function getHeaderActionsConfig(ConpherenceThread $conpherence) {
+    if ($conpherence->getIsRoom()) {
+      $rename_label = pht('Rename Room');
+    } else {
+      $rename_label = pht('Rename Thread');
+    }
+    $can_edit = PhabricatorPolicyFilter::hasCapability(
+      $this->getUser(),
+      $conpherence,
+      PhabricatorPolicyCapability::CAN_EDIT);
+
    return array(
      array(
        'name' => pht('Add Participants'),
+        'disabled' => !$can_edit,
        'href' => '/conpherence/update/'.$conpherence->getID().'/',
        'icon' => 'fa-plus',
        'key' => ConpherenceUpdateActions::ADD_PERSON,
      ),
      array(
-        'name' => pht('Rename Thread'),
+        'name' => $rename_label,
+        'disabled' => !$can_edit,
        'href' => '/conpherence/update/'.$conpherence->getID().'/',
        'icon' => 'fa-pencil',
        'key' => ConpherenceUpdateActions::METADATA,
      ),
      array(
        'name' => pht('View in Conpherence'),
+        'disabled' => false,
        'href' => '/conpherence/'.$conpherence->getID().'/',
        'icon' => 'fa-comments',
        'key' => 'go_conpherence',
      ),
      array(
        'name' => pht('Hide Column'),
+        'disabled' => false,
        'href' => '#',
        'icon' => 'fa-times',
        'key' => 'hide_column',
--- a/src/applications/conpherence/view/ConpherenceLayoutView.php
+++ b/src/applications/conpherence/view/ConpherenceLayoutView.php
@ -68,10 +68,15 @@ final class ConpherenceLayoutView extends AphrontView {
    $selected_id = null;
    $selected_thread_id = null;
    $selected_thread_phid = null;
+    $can_edit_selected = null;
    if ($this->thread) {
      $selected_id = $this->thread->getPHID().'-nav-item';
      $selected_thread_id = $this->thread->getID();
      $selected_thread_phid = $this->thread->getPHID();
+      $can_edit_selected = PhabricatorPolicyFilter::hasCapability(
+        $this->getUser(),
+        $this->thread,
+        PhabricatorPolicyCapability::CAN_EDIT);
    }
    $this->initBehavior('conpherence-menu',
      array(
@ -80,6 +85,7 @@ final class ConpherenceLayoutView extends AphrontView {
        'selectedID' => $selected_id,
        'selectedThreadID' => $selected_thread_id,
        'selectedThreadPHID' => $selected_thread_phid,
+        'canEditSelectedThread' => $can_edit_selected,
        'latestTransactionID' => $this->latestTransactionID,
        'role' => $this->role,
        'hasThreadList' => (bool)$this->threadView,
--- a/src/view/phui/PHUIListItemView.php
+++ b/src/view/phui/PHUIListItemView.php
@ -146,6 +146,10 @@ final class PHUIListItemView extends AphrontTagView {
      $classes[] = 'phui-list-item-selected';
    }

+    if ($this->disabled) {
+      $classes[] = 'phui-list-item-disabled';
+    }
+
    if ($this->statusColor) {
      $classes[] = $this->statusColor;
    }
--- a/webroot/rsrc/css/application/conpherence/widget-pane.css
+++ b/webroot/rsrc/css/application/conpherence/widget-pane.css
@ -57,6 +57,10 @@
  border-top-color: #000;
 }

+.conpherence-widget-pane .widgets-header .phui-icon-view.disabled {
+  color: {$lightgreytext};
+}
+
 .device-desktop .conpherence-layout .device-widgets-selector {
  display: none;
 }
--- a/webroot/rsrc/css/phui/phui-list.css
+++ b/webroot/rsrc/css/phui/phui-list.css
@ -61,6 +61,10 @@
  line-height: 18px;
 }

+.phui-list-sidenav .phui-list-item-disabled .phui-list-item-href {
+  color: {$lightgreytext};
+}
+
 .phui-list-sidenav .phui-list-item-has-icon .phui-list-item-href {
  padding: 2px 10px;
 }
--- a/webroot/rsrc/js/application/conpherence/ConpherenceThreadManager.js
+++ b/webroot/rsrc/js/application/conpherence/ConpherenceThreadManager.js
@ -26,6 +26,7 @@ JX.install('ConpherenceThreadManager', {
    _loadedThreadID: null,
    _loadedThreadPHID: null,
    _latestTransactionID: null,
+    _canEditLoadedThread: null,
    _updating:  null,
    _minimalDisplay: false,
    _willLoadThreadCallback: JX.bag,
@ -80,6 +81,18 @@ JX.install('ConpherenceThreadManager', {
      return this;
    },

+    setCanEditLoadedThread: function(bool) {
+      this._canEditLoadedThread = bool;
+      return this;
+    },
+
+    getCanEditLoadedThread: function() {
+      if (this._canEditLoadedThread === null) {
+        return false;
+      }
+      return this._canEditLoadedThread;
+    },
+
    setMinimalDisplay: function(bool) {
      this._minimalDisplay = bool;
      return this;
@ -255,6 +268,7 @@ JX.install('ConpherenceThreadManager', {
        this._loadedThreadID = r.threadID;
        this._loadedThreadPHID = r.threadPHID;
        this._latestTransactionID = r.latestTransactionID;
+        this._canEditLoadedThread = r.canEdit;
        JX.Stratcom.invoke('notification-panel-update', null, {});

        this._didLoadThreadCallback(r);
--- a/webroot/rsrc/js/application/conpherence/behavior-menu.js
+++ b/webroot/rsrc/js/application/conpherence/behavior-menu.js
@ -185,6 +185,7 @@ JX.behavior('conpherence-menu', function(config) {
      threadManager.setLoadedThreadID(config.selectedThreadID);
      threadManager.setLoadedThreadPHID(config.selectedThreadPHID);
      threadManager.setLatestTransactionID(config.latestTransactionID);
+      threadManager.setCanEditLoadedThread(config.canEditSelectedThread);
      _scrollMessageWindow();
      _focusTextarea();
    } else {
--- a/webroot/rsrc/js/application/conpherence/behavior-widget-pane.js
+++ b/webroot/rsrc/js/application/conpherence/behavior-widget-pane.js
@ -184,6 +184,8 @@ JX.behavior('conpherence-widget-pane', function(config) {
      var widget_pane = JX.DOM.find(root, 'div', 'conpherence-widget-pane');
      var widget_header = JX.DOM.find(widget_pane, 'a', 'widgets-selector');
      var adder = JX.DOM.find(widget_pane, 'a', 'conpherence-widget-adder');
+      var threadManager = JX.ConpherenceThreadManager.getInstance();
+      var disabled = !threadManager.getCanEditLoadedThread();
      JX.DOM.setContent(
        widget_header,
        widget_data.name);
@ -192,6 +194,10 @@ JX.behavior('conpherence-widget-pane', function(config) {
        JX.$N('span', { className : 'caret' }));
      if (widget_data.hasCreate) {
        JX.DOM.show(adder);
+        JX.DOM.alterClass(
+          adder,
+          'disabled',
+          disabled);
      } else {
        JX.DOM.hide(adder);
      }