fix: remove canWrite from IAM — it is IAM RBAC, not our app logic

- IAM permissions.can_write defaults to false for all users
- Our app controls writes via adminMode + company membership

package.json

@@ -1,6 +1,6 @@
 {
   "name": "ipwhitelist",
-  "version": "0.5.53",
+  "version": "0.5.54",
   "description": "IP WhiteList microservice for cloud provider",
   "main": "server.js",
   "scripts": {

src/auth.js

@@ -313,7 +313,6 @@ async function fetchIamUser(token) {
   const activeProfile = profiles.find(p => p.is_active_profile) || profiles[0] || {};
   const ui = raw.userInfo || {};
   const imp = raw.impersonation || {};
-  const perms = raw.permissions || {};
 
   return {
     email:          ui.email || '',
@@ -323,7 +322,6 @@ async function fetchIamUser(token) {
     companyId:      ui.companyId || '',
     companyName:    ui.company || activeProfile.company_name || '',
     isAdmin:        !!ui.isAdmin,
-    canWrite:       perms.can_write !== false,
     isImpersonated: !!(imp.is_impersonated),
     impersonationType:     imp.type || null,
     originalUserEmail:     imp.originalUserEmail || '',

src/routes/oidc.js

@@ -73,7 +73,6 @@ function createRouter({ auth, doubleCsrfProtection, generateCsrfToken, authLimit
           companyId:      iamData.companyId,
           companyName:    iamData.companyName,
           isAdmin:        iamData.isAdmin,
-          canWrite:       iamData.canWrite,
           isImpersonated: iamData.isImpersonated,
           impersonationType:     iamData.impersonationType,
           originalUserEmail:     iamData.originalUserEmail,

ui/index.js

@@ -64,7 +64,6 @@ function createUiRouter({ auth, MOCK_USERS, authLimiter }) {
       const canAdminMode = !!(iamAdmin && activeClientId === ADMIN_CLIENT_ID)
         || (isNail && activeClientId === ADMIN_CLIENT_ID);
       const sessionIsImpersonated = req.session && req.session.user && req.session.user.isImpersonated;
-      const sessionCanWrite = req.session && req.session.user ? req.session.user.canWrite : true;
       req.user = {
         clientId:       rawClientId,
         allClientIds,
@@ -73,7 +72,6 @@ function createUiRouter({ auth, MOCK_USERS, authLimiter }) {
         companyName:    payload.company_name  || payload.companyName || activeClientId,
         email:          req.session?.user?.email || payload.email || payload.login || activeClientId + '@unknown',
         isAdmin:        iamAdmin || isNail,
-        canWrite:       sessionCanWrite,
         isImpersonated: !!sessionIsImpersonated,
         originalUserEmail:    req.session?.user?.originalUserEmail || '',
         originalUserFullName: req.session?.user?.originalUserFullName || '',

ui/routes/entries.js

@@ -121,7 +121,6 @@ function createRouter() {
         canAdminMode:    req.user.canAdminMode,
         isImpersonated:  req.user.isImpersonated,
         originalUserEmail: req.user.originalUserEmail,
-        canWrite:        req.user.canWrite,
         allClientIds:    hasMultiple ? req.user.allClientIds : null,
         activeClientId:  req.user.activeClientId || req.user.clientId,
         profiles,        // из IAM — для UI переключателя
@@ -139,7 +138,6 @@ function createRouter() {
         canAdminMode: req.user.canAdminMode,
         isImpersonated: req.user.isImpersonated,
         originalUserEmail: req.user.originalUserEmail,
-        canWrite: req.user.canWrite,
         companies: [], selectedCompany: null,
         allClientIds: null, activeClientId: null,
         error: 'Ошибка загрузки: ' + e.message,
@@ -151,7 +149,6 @@ function createRouter() {
 
   // POST /add — создать запись
   router.post('/add', async (req, res) => {
-    if (req.user && !req.user.canWrite) return res.status(403).send('Read-only mode');
     const token = api.token(req);
     const { value, comment } = req.body;
     const cq   = companyQuery(req);
@@ -177,7 +174,6 @@ function createRouter() {
 
   // POST /edit/:id — обновить запись
   router.post('/edit/:id', async (req, res) => {
-    if (req.user && !req.user.canWrite) return res.status(403).send('Read-only mode');
     const token = api.token(req);
     const { value, comment } = req.body;
     const cq   = companyQuery(req);
@@ -200,7 +196,6 @@ function createRouter() {
 
   // POST /delete/:id — удалить запись
   router.post('/delete/:id', async (req, res) => {
-    if (req.user && !req.user.canWrite) return res.status(403).send('Read-only mode');
     const token = api.token(req);
     const cq   = companyQuery(req);
     const back = backUrl(req);

views/index.ejs

@@ -190,11 +190,7 @@
       <% } %>
     </div>
   <% } %>
-  <% if (typeof canWrite !== 'undefined' && !canWrite) { %>
+
-    <div style="background:#fee2e2;border:1px solid #dc2626;color:#991b1b;padding:.5rem 1rem;border-radius:8px;margin-bottom:.5rem;font-size:.85rem;">
-      🔒 Режим только для чтения — редактирование запрещено
-    </div>
-  <% } %>
 
   <%
     // Для admin: selectedCompany — выбранная компания (объект из getAllCompanies).
@@ -287,7 +283,6 @@
   </div>
 
   <!-- Форма добавления -->
-  <% if (typeof canWrite === 'undefined' || canWrite) { %>
   <div class="card">
     <div class="card-header">Добавить адрес</div>
     <div class="card-body">
@@ -317,7 +312,6 @@
       </form>
     </div>
   </div>
-  <% } %>
 
   <!-- Таблица -->
   <div class="card">
@@ -351,7 +345,6 @@
                 : '—' %>
             </td>
             <td class="text-center" style="white-space:nowrap;">
-              <% if (typeof canWrite === 'undefined' || canWrite) { %>
               <%
                 // data-* атрибуты для JS-заполнения modal без inline-onclick с параметрами.
                 // Так как комментарий может содержать кавычки — EJS экранирует их в HTML.
@@ -376,7 +369,6 @@
                 <input type="hidden" name="_csrf" value="<%= csrfToken %>">
                 <button class="btn btn-danger">Удалить</button>
               </form>
-              <% } %>
             </td>
           </tr>
           <% }) %>