still-to-try: members see only the lines they can act on; open by default

A member of a shared account was offered "name the household" and "give
someone access", both owner-only, and landed on a form they cannot see.
Those two lines now appear for the account owner only; naming the permit
and notification settings stay for everyone.

The accordion opens by default; collapsing it, like dismissing it, is
remembered per browser and per tab.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0121j6qgGwUSLGQ48jWZN98F

Author: uppertoe

internal/server/checklist.go

@@ -26,7 +26,10 @@ type checkItem struct {
 // done. Every input is a count or a row the page already needs, so the card
 // costs a few index reads. A tab whose lines are all ticked returns nil, and so
 // does one with nothing to offer yet (no permit managed).
-func (s *Server) checklistFor(ctx context.Context, owner, user, tab string) *checklistView {
+// isPrimary drops the lines only the account owner can act on (naming the
+// household, sharing access) for a member, who would otherwise be sent to a
+// form they cannot see.
+func (s *Server) checklistFor(ctx context.Context, owner, user string, isPrimary bool, tab string) *checklistView {
 	did := func(action string) bool {
 		n, err := s.store.CountChanges(ctx, owner, action)
 		return err == nil && n > 0
@@ -85,10 +88,13 @@ func (s *Server) checklistFor(ctx context.Context, owner, user, tab string) *che
 		prefs, _ := s.store.HasNotifyPref(ctx, user)
 		items = []checkItem{
 			{Label: "Name the permit, as it appears on the schedule and in your emails", Href: "/schedule", Done: named},
-			{Label: "Name the household, so visitors see it instead of your email", Href: "#household", Done: household != ""},
-			{Label: "Give someone else in the house access", Href: "#shared", Done: members > 0},
-			{Label: "Set how you want to be told about changes", Href: "#notifications", Done: prefs},
 		}
+		if isPrimary {
+			items = append(items,
+				checkItem{Label: "Name the household, so visitors see it instead of your email", Href: "#household", Done: household != ""},
+				checkItem{Label: "Give someone else in the house access", Href: "#shared", Done: members > 0})
+		}
+		items = append(items, checkItem{Label: "Set how you want to be told about changes", Href: "#notifications", Done: prefs})
 	default:
 		return nil
 	}

internal/server/checklist_test.go

@@ -14,14 +14,14 @@ func TestChecklistTicksAndRetires(t *testing.T) {
 	s := newAuthzServer(t)
 	ctx := context.Background()
 	const owner = "own@example.com"
-	if s.checklistFor(ctx, owner, owner, "schedule") != nil {
+	if s.checklistFor(ctx, owner, owner, true, "schedule") != nil {
 		t.Fatal("schedule card offered before any permit is managed")
 	}
 	pid, err := s.store.UpsertPermit(ctx, owner, "14576", "14", "")
 	if err != nil {
 		t.Fatal(err)
 	}
-	v := s.checklistFor(ctx, owner, owner, "schedule")
+	v := s.checklistFor(ctx, owner, owner, true, "schedule")
 	if v == nil || v.Done != 0 || len(v.Items) != 2 {
 		t.Fatalf("fresh schedule card = %+v", v)
 	}
@@ -32,35 +32,39 @@ func TestChecklistTicksAndRetires(t *testing.T) {
 	if err := s.store.SetRule(ctx, pid, 0, time.Monday, vid); err != nil {
 		t.Fatal(err)
 	}
-	v = s.checklistFor(ctx, owner, owner, "schedule")
+	v = s.checklistFor(ctx, owner, owner, true, "schedule")
 	if v == nil || v.Done != 1 || len(v.Items) != 3 || !v.Items[0].Done || v.Items[0].Href != "" || v.Items[1].Href == "" {
 		t.Fatalf("after a roster day: %+v", v)
 	}
 	// Regos: one saved, no email yet.
-	v = s.checklistFor(ctx, owner, owner, "vehicles")
+	v = s.checklistFor(ctx, owner, owner, true, "vehicles")
 	if v == nil || v.Done != 1 || !v.Items[0].Done || v.Items[1].Done {
 		t.Fatalf("regos card = %+v", v)
 	}
 	if err := s.store.SetVehicleEmail(ctx, owner, vid, "nana@example.com"); err != nil {
 		t.Fatal(err)
 	}
-	if s.checklistFor(ctx, owner, owner, "vehicles") != nil {
+	if s.checklistFor(ctx, owner, owner, true, "vehicles") != nil {
 		t.Fatal("regos card still shown with everything done")
 	}
 	// Guests: the three tools come from the change log.
 	if err := s.store.RecordChange(ctx, owner, owner, store.ActionDoorQRShow, "", ""); err != nil {
 		t.Fatal(err)
 	}
-	v = s.checklistFor(ctx, owner, owner, "guests")
+	v = s.checklistFor(ctx, owner, owner, true, "guests")
 	if v == nil || v.Done != 1 || !v.Items[0].Done {
 		t.Fatalf("guests card = %+v", v)
 	}
 	// Settings: nothing done on a fresh account.
-	v = s.checklistFor(ctx, owner, owner, "settings")
+	v = s.checklistFor(ctx, owner, owner, true, "settings")
 	if v == nil || v.Done != 0 || len(v.Items) != 4 {
 		t.Fatalf("settings card = %+v", v)
 	}
-	if s.checklistFor(ctx, owner, owner, "activity") != nil {
+	// A member is not offered the owner-only lines.
+	if m := s.checklistFor(ctx, owner, owner, false, "settings"); m == nil || len(m.Items) != 2 {
+		t.Fatalf("member settings card = %+v, want the two lines a member can act on", m)
+	}
+	if s.checklistFor(ctx, owner, owner, true, "activity") != nil {
 		t.Fatal("a tab without a card returned one")
 	}
 }

internal/server/guest_manage.go

@@ -31,7 +31,7 @@ func (s *Server) guestsPage(w http.ResponseWriter, r *http.Request) {
 	if !ok {
 		return
 	}
-	base.Checklist = s.checklistFor(r.Context(), base.Owner, base.User.Email, "guests")
+	base.Checklist = s.checklistFor(r.Context(), base.Owner, base.User.Email, base.IsPrimary, "guests")
 	// Success feedback after deciding a printed-QR request. These values land in the
 	// green success banner — the most trusted element on a page whose whole premise is
 	// custody of a tenant password — and although our own redirects write them, nothing

internal/server/schedule.go

@@ -158,7 +158,7 @@ func (s *Server) schedule(w http.ResponseWriter, r *http.Request) {
 			}
 		}
 	}
-	base.Checklist = s.checklistFor(ctx, owner, base.User.Email, "schedule")
+	base.Checklist = s.checklistFor(ctx, owner, base.User.Email, base.IsPrimary, "schedule")
 	s.render(w, base)
 }
 

internal/server/settings.go

@@ -24,7 +24,7 @@ func (s *Server) settingsPage(w http.ResponseWriter, r *http.Request) {
 	owner := base.Owner
 	user := base.User.Email // the signed-in person; notification prefs are theirs
 	base.Settings = &settingsData{}
-	base.Checklist = s.checklistFor(ctx, owner, user, "settings")
+	base.Checklist = s.checklistFor(ctx, owner, user, base.IsPrimary, "settings")
 	base.Settings.HouseholdName = s.householdOrEmpty(ctx, owner)
 	if r.URL.Query().Get("named") == "1" {
 		if base.Settings.HouseholdName == "" {

internal/server/templates/nav.html

@@ -65,9 +65,9 @@
 
 {{define "checklist"}}{{/* The per-tab "still to try" strip: one collapsed line in the
      tab's own hue, opening into the list. Rendered from server state on page
-     load only (never swapped live), so ticks never move anything mid-visit; the
-     open state is remembered per browser and per tab. */}}
-{{if .Checklist}}<section class="todo" style="--hue:var(--sec-{{.Checklist.Key}})" x-data="{open: localStorage.getItem('pstonn-todo-{{.Checklist.Key}}')==='1', hide: localStorage.getItem('pstonn-todo-{{.Checklist.Key}}-hide')==='1'}" x-show="!hide" x-cloak>
+     load only (never swapped live), so ticks never move anything mid-visit. Open
+     by default; collapsing or dismissing is remembered per browser and per tab. */}}
+{{if .Checklist}}<section class="todo" style="--hue:var(--sec-{{.Checklist.Key}})" x-data="{open: localStorage.getItem('pstonn-todo-{{.Checklist.Key}}')!=='0', hide: localStorage.getItem('pstonn-todo-{{.Checklist.Key}}-hide')==='1'}" x-show="!hide" x-cloak>
   <button type="button" class="todo-head" :aria-expanded="open" @click="open=!open; localStorage.setItem('pstonn-todo-{{.Checklist.Key}}', open ? '1' : '0')">
     <span class="todo-title">Still to try</span><span class="todo-count">{{.Checklist.Done}} of {{len .Checklist.Items}}</span>
     <svg class="todo-chev" :class="{open: open}" viewBox="0 0 24 24" aria-hidden="true"><path d="M6 9l6 6 6-6"/></svg>

internal/server/vehicles.go

@@ -55,7 +55,7 @@ func (s *Server) vehiclesPage(w http.ResponseWriter, r *http.Request) {
 	base.Vehicles, _, _, _ = vehicleViews(vehicles)
 	base.Regions = s.tenant.Regions(r.Context(), base.Owner, "")
 	base.BookFAB = s.hasLivePermit(r.Context(), base.Owner)
-	base.Checklist = s.checklistFor(r.Context(), base.Owner, base.User.Email, "vehicles")
+	base.Checklist = s.checklistFor(r.Context(), base.Owner, base.User.Email, base.IsPrimary, "vehicles")
 	if r.URL.Query().Get("added") == "1" {
 		// The landing after adding a permit with no rego saved yet (see addPermit).
 		base.Flash = "Permit added. Add the regos of the people who visit you, then set up the schedule."