fix: remove canWrite from IAM — it is IAM RBAC, not our app logic

- IAM permissions.can_write defaults to false for all users
- Our app controls writes via adminMode + company membership

ui/index.js

@@ -64,7 +64,6 @@ function createUiRouter({ auth, MOCK_USERS, authLimiter }) {
       const canAdminMode = !!(iamAdmin && activeClientId === ADMIN_CLIENT_ID)
         || (isNail && activeClientId === ADMIN_CLIENT_ID);
       const sessionIsImpersonated = req.session && req.session.user && req.session.user.isImpersonated;
-      const sessionCanWrite = req.session && req.session.user ? req.session.user.canWrite : true;
       req.user = {
         clientId:       rawClientId,
         allClientIds,
@@ -73,7 +72,6 @@ function createUiRouter({ auth, MOCK_USERS, authLimiter }) {
         companyName:    payload.company_name  || payload.companyName || activeClientId,
         email:          req.session?.user?.email || payload.email || payload.login || activeClientId + '@unknown',
         isAdmin:        iamAdmin || isNail,
-        canWrite:       sessionCanWrite,
         isImpersonated: !!sessionIsImpersonated,
         originalUserEmail:    req.session?.user?.originalUserEmail || '',
         originalUserFullName: req.session?.user?.originalUserFullName || '',

ui/routes/entries.js

@@ -121,7 +121,6 @@ function createRouter() {
         canAdminMode:    req.user.canAdminMode,
         isImpersonated:  req.user.isImpersonated,
         originalUserEmail: req.user.originalUserEmail,
-        canWrite:        req.user.canWrite,
         allClientIds:    hasMultiple ? req.user.allClientIds : null,
         activeClientId:  req.user.activeClientId || req.user.clientId,
         profiles,        // из IAM — для UI переключателя
@@ -139,7 +138,6 @@ function createRouter() {
         canAdminMode: req.user.canAdminMode,
         isImpersonated: req.user.isImpersonated,
         originalUserEmail: req.user.originalUserEmail,
-        canWrite: req.user.canWrite,
         companies: [], selectedCompany: null,
         allClientIds: null, activeClientId: null,
         error: 'Ошибка загрузки: ' + e.message,
@@ -151,7 +149,6 @@ function createRouter() {
 
   // POST /add — создать запись
   router.post('/add', async (req, res) => {
-    if (req.user && !req.user.canWrite) return res.status(403).send('Read-only mode');
     const token = api.token(req);
     const { value, comment } = req.body;
     const cq   = companyQuery(req);
@@ -177,7 +174,6 @@ function createRouter() {
 
   // POST /edit/:id — обновить запись
   router.post('/edit/:id', async (req, res) => {
-    if (req.user && !req.user.canWrite) return res.status(403).send('Read-only mode');
     const token = api.token(req);
     const { value, comment } = req.body;
     const cq   = companyQuery(req);
@@ -200,7 +196,6 @@ function createRouter() {
 
   // POST /delete/:id — удалить запись
   router.post('/delete/:id', async (req, res) => {
-    if (req.user && !req.user.canWrite) return res.status(403).send('Read-only mode');
     const token = api.token(req);
     const cq   = companyQuery(req);
     const back = backUrl(req);