From 20e7e834c255ffaaa9c12f44f1f93cc7334a140c Mon Sep 17 00:00:00 2001 From: Ali <010109ali@gmail.com> Date: Sun, 21 Jun 2026 09:58:43 +0000 Subject: [PATCH] feat: global blocked_doctypes list (block doctypes not on /desk) desk_layout._build merges a top-level config 'blocked_doctypes' list into the blocked-doctype set, so arbitrary doctypes (including ones absent from any workspace card) are denied at before_request + has_permission when enforcing. Co-Authored-By: Claude Opus 4.8 --- jey_theme/desk_layout.py | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/jey_theme/desk_layout.py b/jey_theme/desk_layout.py index 4fc82c9..bbe6f11 100644 --- a/jey_theme/desk_layout.py +++ b/jey_theme/desk_layout.py @@ -201,6 +201,11 @@ def _build_inner() -> dict: elif ltype == "Page": blocked_pages.add(lto) + # Global block list — doctypes blocked anywhere, including ones not on /desk. + for dt in layout.get("blocked_doctypes") or []: + if isinstance(dt, str) and dt: + blocked_doctypes.add(dt) + return { "workspaces": workspaces, "hidden_ws": frozenset(hidden_ws),