security upgrade

static/js/note-files.js

@@ -11,7 +11,6 @@ import { api, uploadWithProgress } from "@rustpad/api";
 import { copyText } from "@rustpad/clipboard";
 import { prepareImageFile } from "@rustpad/image-upload";
 import { askConfirm } from "@rustpad/modal";
-import { getAuthToken } from "@rustpad/session";
 import { safeAppUrl } from "@rustpad/security";
 import { createUploadToast } from "@rustpad/toast";
 
@@ -41,7 +40,7 @@ function markdownCode(url, label, mimeType) {
   return String(mimeType || "").startsWith("image/") ? `![${label}](${url})` : `[${label}](${url})`;
 }
 
-export function bindNoteFiles({ editor, endpoints, getAccessToken, canDelete, toast, onFilesChanged = () => {} }) {
+export function bindNoteFiles({ editor, endpoints, getAccessToken, canDelete, canUpload, toast, onFilesChanged = () => {} }) {
   const dialog = document.querySelector("#files-dialog");
   const list = document.querySelector("#files-list");
   const input = document.querySelector("#file-input");
@@ -75,8 +74,8 @@ export function bindNoteFiles({ editor, endpoints, getAccessToken, canDelete, to
   }
 
   document.querySelector("#upload-button").addEventListener("click", () => {
-    if (!getAuthToken() && !getAccessToken()) {
-      toast("Log in or use a read-write share link to upload files.");
+    if (!canUpload()) {
+      toast("Log in with read-write access to upload files.");
       return;
     }
     input.click();