From b5b91d0df51c35e82af79bcbe204989026ca6acb Mon Sep 17 00:00:00 2001
From: Roman Priesol <roman@priesol.net>
Date: Wed, 9 Sep 2026 12:44:52 +0200
Subject: [PATCH] Gate note-writing UI behind login
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Adding a note (either tool) always ended in a 401 for a logged-out
viewer — the write-only affordance just wasn't hidden yet, unlike
GpxPanelControl's own upload/new-folder buttons, which already are.

NotesControl isn't added to the map at all when logged out (its whole
purpose is writing); MeasureControl's "Save as note" button is hidden
but the tool itself stays usable for plain measuring either way.
---
 public/css/style.css | 6 ++++++
 public/js/map.js     | 7 ++++++-
 public/js/measure.js | 5 +++++
 3 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/public/css/style.css b/public/css/style.css
index 3223bcd..0f385bd 100644
--- a/public/css/style.css
+++ b/public/css/style.css
@@ -717,6 +717,12 @@ html, body {
   cursor: default;
 }
 
+/* Same "author display wins over the UA [hidden] rule" gotcha as
+   .gpx-panel__action[hidden] elsewhere in this file. */
+.measure-panel__save[hidden] {
+  display: none;
+}
+
 .measure-panel .notes-panel__form {
   width: 200px;
 }
diff --git a/public/js/map.js b/public/js/map.js
index 45ce942..d3f6c39 100644
--- a/public/js/map.js
+++ b/public/js/map.js
@@ -14,6 +14,7 @@ import { NotesControl } from "/js/notes.js";
 import { LocateControl } from "/js/locate.js";
 import { LAYERS_ICON, HILLSHADE_ICON } from "/js/icons.js";
 import { notifySidePanelOpen, onlyOneSidePanelOpen } from "/js/panels.js";
+import { isLoggedIn } from "/js/auth.js";
 import HomeButton from "/vendor/npmap-home-button/home-button.esm.js";
 import OverviewMap from "/vendor/npmap-overview/overview.esm.js";
 import * as maplibregl from "/vendor/maplibre-gl/maplibre-gl.mjs";
@@ -501,7 +502,11 @@ map.addControl(new HomeButton({ bounds: SLOVAKIA_BOUNDS }), "top-left");
 map.addControl(new NavigationControl({ showCompass: false }), "top-left");
 map.addControl(new ZoomLevelControl(), "top-left");
 map.addControl(new MeasureControl(), "top-left");
-map.addControl(new NotesControl(), "top-left");
+// Writing a note needs a login (POST /api/gpx/notes) — no point adding a
+// button that can only ever end in a 401 for a logged-out viewer, same
+// "hide the write-only affordance" story as GpxPanelControl's own
+// upload/new-folder buttons.
+if (isLoggedIn()) map.addControl(new NotesControl(), "top-left");
 // Constructed here (rather than down where it's mounted, alongside the
 // other sidebar controls) so LocateControl can hold the same instance —
 // its constructor only touches `map`, mount() (which needs the sidebar
diff --git a/public/js/measure.js b/public/js/measure.js
index 3c47add..f452dc8 100644
--- a/public/js/measure.js
+++ b/public/js/measure.js
@@ -1,5 +1,6 @@
 import { RULER_ICON } from "/js/icons.js";
 import { NoteSaveForm } from "/js/notes.js";
+import { isLoggedIn } from "/js/auth.js";
 
 const SOURCE_ID = "measure";
 const LINE_LAYER_ID = "measure-line";
@@ -44,6 +45,10 @@ export class MeasureControl {
     this._controls = this._container.querySelector(".measure-panel__controls");
     this._result = this._container.querySelector(".measure-panel__result");
     this._saveButton = this._container.querySelector(".measure-panel__save");
+    // Same "hide the write-only affordance for a logged-out viewer" story
+    // as notes.js's own button not being added at all — Measure itself
+    // stays available either way, only saving needs a login.
+    if (!isLoggedIn()) this._saveButton.hidden = true;
 
     this._noteForm = new NoteSaveForm(this._panel, {
       onSaved: () => {