From 58c9073656c4be996fa5f74fd03c579dc7d1de53 Mon Sep 17 00:00:00 2001
From: Guilhem Lemouel <guilhemlemouel@gmail.com>
Date: Mon, 7 Sep 2026 13:09:44 +0200
Subject: [PATCH] fix(frontend): close the advanced-settings bypass while the
 policy is unknown
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Create was gated on knowing whether the instance derives usernames, and
the link beside it went to a form with no such gate — so the way around
the block sat next to it. It is disabled until the policy is known, with
a title saying why.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012fRjnaHLwjpHN84gNNxah9
---
 .../workspaceSettings/SimpleCreateWorkspace.svelte         | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/frontend/src/lib/components/workspaceSettings/SimpleCreateWorkspace.svelte b/frontend/src/lib/components/workspaceSettings/SimpleCreateWorkspace.svelte
index 49e7181e9a..de75852a38 100644
--- a/frontend/src/lib/components/workspaceSettings/SimpleCreateWorkspace.svelte
+++ b/frontend/src/lib/components/workspaceSettings/SimpleCreateWorkspace.svelte
@@ -191,8 +191,13 @@
 				{@render leading?.()}
 				<!-- A bare <button> as a quiet text link, signed off by design: a second <Button> here
 				     would compete with Create workspace for the eye. -->
+				<!-- Closed while the policy is unknown, or it would be a way around the gate beside
+				     it: the full form asks the same question of the same setting and submits on
+				     its own optimistic default, so with no policy neither route creates. -->
 				<button
-					class="text-xs text-secondary hover:text-emphasis"
+					class="text-xs text-secondary hover:text-emphasis disabled:opacity-50 disabled:hover:text-secondary"
+					disabled={!policyLoaded}
+					title={policyLoaded ? undefined : "This instance's settings could not be read"}
 					onclick={() => (advanced = true)}
 				>
 					Advanced settings