/* ============================================
   Role-based UI: hide write controls for read-only users (partners, guests, analysts).
   The API enforces the same rules — this only keeps the UI clean.
   body.read-only-user / body.partner-view are set in app.js applyPermissionsToNav()
   ============================================ */

body.read-only-user [onclick^='openModal('],
body.read-only-user [onclick^='openUserModal('],
body.read-only-user [onclick^='openRoleModal('],
body.read-only-user [onclick^='openBulkImportModal('],
body.read-only-user [onclick^='openPaymentScheduleGenerator('],
body.read-only-user [onclick^='edit'],
body.read-only-user [onclick^='delete'],
body.read-only-user [onclick^='confirmDelete'],
body.read-only-user [onclick^='add'],
body.read-only-user [onclick^='remove'],
body.read-only-user [onclick^='applyBulkEdit('],
body.read-only-user [onclick^='processBulkImport('],
body.read-only-user [onclick^='importData('],
body.read-only-user [onclick^='saveSettings('],
body.read-only-user [onclick^='saveEmailSettings('],
body.read-only-user [onclick^='resetSettings('],
body.read-only-user [onclick*='markPaid'],
body.read-only-user [onclick*='MarkPaid'],
body.read-only-user .bulk-actions,
body.read-only-user .quick-actions-card,
body.read-only-user [data-write-action],
body.read-only-user .control-group:has(.action-btn[onclick^='openModal(']) {
    display: none !important;
}

/* Small badge next to the user name so partners know the view is personal */
body.partner-view .user-name::after {
    content: ' · My portfolio';
    font-weight: 400;
    opacity: 0.7;
}

/* Partners: the office Dropbox path of each paper is internal */
body.partner-view .dp-src {
    display: none;
}