From 2f3444adb841980ac6ba102032653024298f03d9 Mon Sep 17 00:00:00 2001
From: rajch_ales <rajch_ales@ma-al.com>
Date: Wed, 5 Aug 2026 19:05:07 +0200
Subject: [PATCH] Connect local write permissions to backend

---
 public/app.js                    |  7 +++++++
 public/app.ts                    |  7 +++++++
 src/server.ts                    |  3 +++
 src/services/catalog-products.ts | 15 +++++++++------
 4 files changed, 26 insertions(+), 6 deletions(-)

diff --git a/public/app.js b/public/app.js
index 3c5ccf2..6e9689b 100644
--- a/public/app.js
+++ b/public/app.js
@@ -62,9 +62,16 @@ window.fetch = (input, init = {}) => {
         return nativeFetch(input, init);
     const headers = new Headers(init.headers || (typeof input !== "string" ? input.headers : undefined));
     const selectedMode = localStorage.getItem("catalog-maker:database-mode") || "local";
+    const permissions = JSON.parse(localStorage.getItem("catalog-maker:db-permissions") || "{}");
+    const localWritesEnabled = selectedMode === "local" && [
+        permissions.allowInsertToggle,
+        permissions.allowUpdateToggle,
+        permissions.allowDeleteToggle,
+    ].some(Boolean);
     // Scrape storage is separate; existing catalog endpoints continue reading Local 9bplus.
     headers.set("X-Database-Mode", selectedMode === "live" ? "live" : "local");
     headers.set("X-Scrape-Database", selectedMode === "scrape" ? "1" : "0");
+    headers.set("X-Local-Write-Access", localWritesEnabled ? "1" : "0");
     return nativeFetch(input, { ...init, headers });
 };
 let currentPosition = 1;
diff --git a/public/app.ts b/public/app.ts
index 556ed77..a5de41a 100644
--- a/public/app.ts
+++ b/public/app.ts
@@ -63,9 +63,16 @@ window.fetch = (input, init = {}) => {
 
   const headers = new Headers(init.headers || (typeof input !== "string" ? input.headers : undefined));
   const selectedMode = localStorage.getItem("catalog-maker:database-mode") || "local";
+  const permissions = JSON.parse(localStorage.getItem("catalog-maker:db-permissions") || "{}");
+  const localWritesEnabled = selectedMode === "local" && [
+    permissions.allowInsertToggle,
+    permissions.allowUpdateToggle,
+    permissions.allowDeleteToggle,
+  ].some(Boolean);
   // Scrape storage is separate; existing catalog endpoints continue reading Local 9bplus.
   headers.set("X-Database-Mode", selectedMode === "live" ? "live" : "local");
   headers.set("X-Scrape-Database", selectedMode === "scrape" ? "1" : "0");
+  headers.set("X-Local-Write-Access", localWritesEnabled ? "1" : "0");
   return nativeFetch(input, { ...init, headers });
 };
 
diff --git a/src/server.ts b/src/server.ts
index a8cbde3..c1ad4c3 100644
--- a/src/server.ts
+++ b/src/server.ts
@@ -230,6 +230,9 @@ function getRequestConfig(request) {
     database: {
       ...config.database,
       mode: selectedMode,
+      allowWrites: selectedMode === "local"
+        && config.database.allowWrites
+        && request.headers["x-local-write-access"] === "1",
     },
   };
 }
diff --git a/src/services/catalog-products.ts b/src/services/catalog-products.ts
index 62b5ad6..f1d869a 100644
--- a/src/services/catalog-products.ts
+++ b/src/services/catalog-products.ts
@@ -13,12 +13,14 @@ import {
 
 export async function loadManufacturerCatalogState(config, { manufacturerId, position = 1 }) {
   const refreshResults = [];
-  for (const sql of prepareManufacturerCatalogSqls({ manufacturerId })) {
-    refreshResults.push(
-      await executeEndpointWrite(config, sql, {
-        operation: "catalog-maker-refresh-manufacturer",
-      }),
-    );
+  if (config.database?.mode === "local" && config.database.allowWrites) {
+    for (const sql of prepareManufacturerCatalogSqls({ manufacturerId })) {
+      refreshResults.push(
+        await executeEndpointWrite(config, sql, {
+          operation: "catalog-maker-refresh-manufacturer",
+        }),
+      );
+    }
   }
 
   const productResult = await queryEndpoint(
@@ -49,6 +51,7 @@ export async function loadManufacturerCatalogState(config, { manufacturerId, pos
     refresh: {
       operation: "catalog-maker-refresh-manufacturer",
       statements: refreshResults.length,
+      skipped: refreshResults.length === 0,
     },
     product: normalizeProduct(product),
     combinations: combinationsResult.items.map(normalizeCombination),