From 3bd9325bee973dd7c890ea475134df814bcf320b Mon Sep 17 00:00:00 2001
From: Matthew Meszaros <meszmatew@gmail.com>
Date: Sun, 30 Aug 2026 00:11:19 -0700
Subject: [PATCH] feat: address review on segments: gate the add-to-campaign
 and from-segment actions behind the manage-campaigns permission on the
 segment page, the segments list and the campaign Leads tab so the dashboard
 never offers an enrolment the API would refuse, trim the segment package and
 migration comments to the one invariant they carry, and drop the em dash from
 the editor comment

---
 internal/app/segment/service.go                            | 5 ++---
 .../infrastructure/db/migrations/000110_segments.up.sql    | 7 ++-----
 web/src/app/app/segments/[id]/page.tsx                     | 4 +++-
 web/src/app/app/segments/page.tsx                          | 4 +++-
 web/src/components/app/contacts/ContactsTable.tsx          | 5 ++++-
 web/src/components/app/segments/SegmentEditor.tsx          | 2 +-
 6 files changed, 15 insertions(+), 12 deletions(-)

diff --git a/internal/app/segment/service.go b/internal/app/segment/service.go
index 8c6a5537..17275c72 100644
--- a/internal/app/segment/service.go
+++ b/internal/app/segment/service.go
@@ -1,6 +1,5 @@
-// Package segment manages saved contact audiences (issue #266). A segment is
-// a filter definition plus manual overrides; membership is computed at read
-// time by the repository's SQL compiler, so nothing here schedules work.
+// Package segment manages saved contact audiences; membership is computed at
+// read time, so nothing here schedules work.
 package segment
 
 import (
diff --git a/internal/infrastructure/db/migrations/000110_segments.up.sql b/internal/infrastructure/db/migrations/000110_segments.up.sql
index 839751b6..dc8ba5c3 100644
--- a/internal/infrastructure/db/migrations/000110_segments.up.sql
+++ b/internal/infrastructure/db/migrations/000110_segments.up.sql
@@ -1,8 +1,5 @@
--- Contact segments (issue #266): saved, reusable audiences. A segment is a
--- filter tree over contacts (properties, categories, campaign activity,
--- engagement, other segments) plus per-contact manual overrides. Membership
--- is evaluated at read time, so it is always current and never needs a
--- recompute job; only the definition and the overrides are stored.
+-- Contact segments (issue #266). Membership is evaluated at read time; only
+-- the definition and the manual overrides are stored.
 CREATE TABLE public.segments (
     id uuid DEFAULT gen_random_uuid() PRIMARY KEY,
     organization_id uuid NOT NULL REFERENCES public.organizations(id) ON DELETE CASCADE,
diff --git a/web/src/app/app/segments/[id]/page.tsx b/web/src/app/app/segments/[id]/page.tsx
index 1bf071e8..6131f752 100644
--- a/web/src/app/app/segments/[id]/page.tsx
+++ b/web/src/app/app/segments/[id]/page.tsx
@@ -37,6 +37,8 @@ function SegmentDetail() {
     const navigate = useNavigate();
     const confirm = useConfirm();
     const write = useWriteGuard("MANAGE_CONTACTS");
+    // Enrolment writes campaign leads, so it takes the campaign permission.
+    const campaigns = useWriteGuard("MANAGE_CAMPAIGNS");
     const segment = useSegment(id);
     const fields = useSegmentFields();
     const remove = useDeleteSegment();
@@ -104,7 +106,7 @@ function SegmentDetail() {
                         </button>
                         <button
                             type="button"
-                            onClick={() => setCampaignOpen(true)}
+                            onClick={campaigns.guard(() => setCampaignOpen(true))}
                             className="h-7 px-2.5 rounded-md bg-sky-600 hover:bg-sky-700 text-white text-[12px] font-medium inline-flex items-center gap-1.5 transition-colors"
                         >
                             <MegaphoneIcon className="w-3 h-3" />
diff --git a/web/src/app/app/segments/page.tsx b/web/src/app/app/segments/page.tsx
index c797a23f..79110828 100644
--- a/web/src/app/app/segments/page.tsx
+++ b/web/src/app/app/segments/page.tsx
@@ -38,6 +38,8 @@ function SegmentsList() {
     // Menu items and topbar actions take a bare () => void, so give the
     // permission guard an empty event to swallow.
     const guarded = (fn: () => void) => () => write.guard(fn)({});
+    const campaigns = useWriteGuard("MANAGE_CAMPAIGNS");
+    const campaignGuarded = (fn: () => void) => () => campaigns.guard(fn)({});
     const segments = useSegments();
     const remove = useDeleteSegment();
     const create = useCreateSegment();
@@ -198,7 +200,7 @@ function SegmentsList() {
                                     <PopoverMenuContent minWidth={180}>
                                         <PopoverMenuItem onSelect={() => navigate(`/app/segments/${s.id}`)}>View contacts</PopoverMenuItem>
                                         <PopoverMenuItem onSelect={guarded(() => openEdit(s))}>Edit conditions</PopoverMenuItem>
-                                        <PopoverMenuItem onSelect={() => setCampaignFor(s)}>Add to campaign</PopoverMenuItem>
+                                        <PopoverMenuItem onSelect={campaignGuarded(() => setCampaignFor(s))}>Add to campaign</PopoverMenuItem>
                                         <PopoverMenuItem onSelect={guarded(() => duplicate(s))}>Duplicate</PopoverMenuItem>
                                         <PopoverMenuSeparator />
                                         <PopoverMenuItem onSelect={guarded(() => askDelete(s))}>Delete</PopoverMenuItem>
diff --git a/web/src/components/app/contacts/ContactsTable.tsx b/web/src/components/app/contacts/ContactsTable.tsx
index 0b085590..82359b05 100644
--- a/web/src/components/app/contacts/ContactsTable.tsx
+++ b/web/src/components/app/contacts/ContactsTable.tsx
@@ -40,6 +40,7 @@ import {
 } from "lucide-react";
 
 import { useConfirm } from "@/hooks/context/confirm";
+import { useWriteGuard } from "@/hooks/usePermission";
 import useSearchContacts from "@/lib/api/hooks/app/contacts/useSearchContacts";
 import type SearchContacts from "@/lib/api/models/app/contacts/SearchContacts";
 import useDeleteContacts from "@/lib/api/hooks/app/contacts/useDeleteContacts";
@@ -105,6 +106,8 @@ export default function ContactsTable({
 }) {
     const confirm = useConfirm();
     const segmentMembers = useSetSegmentMembers();
+    // Enrolling a segment writes campaign leads, so it takes the campaign permission.
+    const campaignWrite = useWriteGuard("MANAGE_CAMPAIGNS");
     const [selected, setSelected] = React.useState<string[]>([]);
     const [del, setDelete] = React.useState<boolean>(false);
     const [filtersOpen, setFiltersOpen] = React.useState<boolean>(false);
@@ -341,7 +344,7 @@ export default function ContactsTable({
                         <TopbarAction
                             variant="ghost"
                             icon={<LayersIcon className="w-3 h-3" />}
-                            onClick={() => setFromSegmentOpen(true)}
+                            onClick={() => campaignWrite.guard(() => setFromSegmentOpen(true))({})}
                         >
                             From segment
                         </TopbarAction>
diff --git a/web/src/components/app/segments/SegmentEditor.tsx b/web/src/components/app/segments/SegmentEditor.tsx
index d07aa68d..4d11d395 100644
--- a/web/src/components/app/segments/SegmentEditor.tsx
+++ b/web/src/components/app/segments/SegmentEditor.tsx
@@ -1,4 +1,4 @@
-// SegmentEditor — right-side drawer that creates or edits a segment: name,
+// SegmentEditor: right-side drawer that creates or edits a segment: name,
 // color, all/any match and the condition list, with a live "matches N
 // contacts" preview fed by POST /segments/preview.