fix ux

backend/app/routes/dashboard.py

@@ -4,7 +4,7 @@ from datetime import datetime, timezone
 import os
 import platform
 
-from flask import Blueprint, jsonify, request
+from flask import Blueprint, jsonify, request, session
 
 from app.core_settings import get_settings
 from app.services.capabilities import build_capabilities
@@ -19,6 +19,27 @@ dashboard_blueprint = Blueprint("dashboard", __name__)
 _APP_STARTED_AT = datetime.now(timezone.utc)
 
 
+def _resolve_kiosk_mode(requested_mode: str, require_write_access: bool = False) -> tuple[str, str]:
+    normalized_mode = (requested_mode or "private").strip().lower()
+    auth_service = get_auth_service()
+
+    if normalized_mode == "public":
+        if require_write_access and auth_service.enabled and session.get("auth_role") != "admin":
+            raise PermissionError("Brak uprawnien do edycji publicznego kiosku")
+        return "public", "public"
+
+    if normalized_mode != "private":
+        raise ValueError("Mode musi byc jednym z: public, private")
+
+    if (not auth_service.enabled) or session.get("auth_role") == "admin":
+        return "private", "private"
+
+    username = session.get("auth_user")
+    if not username:
+        raise PermissionError("Authentication required")
+    return f"user:{username}", "private"
+
+
 @dashboard_blueprint.get("/dashboard/config")
 def dashboard_config():
     settings = get_settings()
@@ -65,8 +86,12 @@ def dashboard_config():
 def dashboard_kiosk_settings():
     requested_mode = request.args.get("mode") or ("public" if request.args.get("publicKiosk") == "1" else "private")
     try:
-        payload = get_kiosk_settings_service().get(requested_mode)
+        storage_mode, response_mode = _resolve_kiosk_mode(requested_mode)
+        payload = get_kiosk_settings_service().get(storage_mode)
+        payload["mode"] = response_mode
         return jsonify(to_plain(payload))
+    except PermissionError as exc:
+        return jsonify({"detail": str(exc)}), 403
     except ValueError as exc:
         return jsonify({"detail": str(exc)}), 400
 
@@ -74,11 +99,11 @@ def dashboard_kiosk_settings():
 @dashboard_blueprint.put("/dashboard/kiosk-settings")
 def update_dashboard_kiosk_settings():
     payload = request.get_json(silent=True) or {}
-    mode = payload.get("mode", "private")
-    auth_service = get_auth_service()
+    requested_mode = payload.get("mode", "private")
     try:
-        auth_service.require_admin()
-        updated = get_kiosk_settings_service().update_from_session(mode, payload)
+        storage_mode, response_mode = _resolve_kiosk_mode(requested_mode, require_write_access=True)
+        updated = get_kiosk_settings_service().update_from_session(storage_mode, payload)
+        updated["mode"] = response_mode
         return jsonify(to_plain(updated))
     except PermissionError as exc:
         return jsonify({"detail": str(exc)}), 403
@@ -88,6 +113,12 @@ def update_dashboard_kiosk_settings():
 
 @dashboard_blueprint.get("/dashboard/diagnostics")
 def dashboard_diagnostics():
+    auth_service = get_auth_service()
+    try:
+        auth_service.require_admin()
+    except PermissionError as exc:
+        return jsonify({"detail": str(exc)}), 403
+
     settings = get_settings()
     influx_diagnostics = InfluxHTTPService(settings).diagnose()
     now = datetime.now(timezone.utc)