From 59984fc8be53dfe5b17d45edbe86d16ed92c92aa Mon Sep 17 00:00:00 2001
From: Artem Savchenko <armisav@gmail.com>
Date: Fri, 6 Mar 2026 16:25:30 +0700
Subject: [PATCH 1/2] Make issues read-only for guests

Signed-off-by: Artem Savchenko <armisav@gmail.com>
---
 .../components/issues/edit/EditIssue.svelte   | 38 +++++++++++++------
 plugins/tracker-resources/src/utils.ts        | 29 +++++++++++++-
 2 files changed, 55 insertions(+), 12 deletions(-)

diff --git a/plugins/tracker-resources/src/components/issues/edit/EditIssue.svelte b/plugins/tracker-resources/src/components/issues/edit/EditIssue.svelte
index bd3dd4333bc..bf7de0a5db4 100644
--- a/plugins/tracker-resources/src/components/issues/edit/EditIssue.svelte
+++ b/plugins/tracker-resources/src/components/issues/edit/EditIssue.svelte
@@ -47,6 +47,7 @@
 
   import { createEventDispatcher, onDestroy } from 'svelte'
   import { generateIssueShortLink, getIssueIdByIdentifier } from '../../../issues'
+  import { canEditIssue } from '../../../utils'
   import tracker from '../../../plugin'
   import IssueStatusActivity from '../IssueStatusActivity.svelte'
   import ControlPanel from './ControlPanel.svelte'
@@ -72,6 +73,18 @@
   let descriptionBox: AttachmentStyleBoxCollabEditor
   let showAllMixins: boolean
 
+  let effectiveReadonly = true
+  $: if (issue !== undefined) {
+    const currentIssue = issue
+    void canEditIssue(currentIssue).then((canEdit) => {
+      if (issue === currentIssue) {
+        effectiveReadonly = readonly || !canEdit
+      }
+    })
+  } else {
+    effectiveReadonly = readonly
+  }
+
   const inboxClient = InboxNotificationsClientImpl.getClient()
 
   let issueId: Ref<Issue> | undefined
@@ -198,7 +211,7 @@
   <Panel
     object={issue}
     isHeader={false}
-    withoutInput={readonly}
+    withoutInput={effectiveReadonly}
     allowClose={!embedded}
     isAside={true}
     isSub={false}
@@ -233,17 +246,17 @@
       {/if}
       <ComponentExtensions
         extension={tracker.extensions.EditIssueTitle}
-        props={{ size: 'medium', kind: 'ghost', space: issue.space, value: issue, readonly }}
+        props={{ size: 'medium', kind: 'ghost', space: issue.space, value: issue, readonly: effectiveReadonly }}
       />
     </svelte:fragment>
     <svelte:fragment slot="pre-utils">
       <ComponentExtensions
         extension={view.extensions.EditDocTitleExtension}
-        props={{ size: 'medium', kind: 'ghost', _id, _class, value: issue, readonly }}
+        props={{ size: 'medium', kind: 'ghost', _id, _class, value: issue, readonly: effectiveReadonly }}
       />
       <ComponentExtensions
         extension={tracker.extensions.EditIssueHeader}
-        props={{ size: 'medium', kind: 'ghost', space: issue.space, readonly, value: issue }}
+        props={{ size: 'medium', kind: 'ghost', space: issue.space, readonly: effectiveReadonly, value: issue }}
       />
       {#if saved}
         <Label label={presentation.string.Saved} />
@@ -251,7 +264,7 @@
     </svelte:fragment>
 
     <svelte:fragment slot="utils">
-      {#if !readonly}
+      {#if !effectiveReadonly}
         <Button
           icon={IconMoreH}
           iconProps={{ size: 'medium' }}
@@ -294,7 +307,7 @@
     {#if hasParentIssue}
       <div class="mb-6 flex-row-center">
         <SubIssueSelector {issue} />
-        {#if !readonly}
+        {#if !effectiveReadonly}
           <div class="ml-2">
             <Button
               icon={tracker.icon.UnsetParent}
@@ -313,7 +326,7 @@
     <EditBox
       focusIndex={1}
       bind:value={title}
-      disabled={readonly}
+      disabled={effectiveReadonly}
       placeholder={tracker.string.IssueTitlePlaceholder}
       kind="large-style"
       on:blur={save}
@@ -322,7 +335,7 @@
       <AttachmentStyleBoxCollabEditor
         focusIndex={30}
         object={issue}
-        {readonly}
+        readonly={effectiveReadonly}
         key={{ key: 'description', attr: descriptionKey }}
         bind:this={descriptionBox}
         identifier={issue?.identifier}
@@ -339,11 +352,14 @@
       {/key}
     </div>
 
-    <RelationsEditor object={issue} {readonly} />
+    <RelationsEditor object={issue} readonly={effectiveReadonly} />
 
     {#if editorFooter}
       <div class="step-tb-6">
-        <Component is={editorFooter.footer} props={{ object: issue, _class, ...editorFooter.props, readonly }} />
+        <Component
+          is={editorFooter.footer}
+          props={{ object: issue, _class, ...editorFooter.props, readonly: effectiveReadonly }}
+        />
       </div>
     {/if}
 
@@ -354,7 +370,7 @@
     <svelte:fragment slot="custom-attributes">
       {#if issue !== undefined}
         <div class="space-divider" />
-        <ControlPanel {issue} {showAllMixins} {readonly} />
+        <ControlPanel {issue} {showAllMixins} readonly={effectiveReadonly} />
       {/if}
 
       <div class="popupPanel-body__aside-grid">
diff --git a/plugins/tracker-resources/src/utils.ts b/plugins/tracker-resources/src/utils.ts
index b2679c1086c..65528eab279 100644
--- a/plugins/tracker-resources/src/utils.ts
+++ b/plugins/tracker-resources/src/utils.ts
@@ -16,6 +16,7 @@
 import { Analytics } from '@hcengineering/analytics'
 import { type Person } from '@hcengineering/contact'
 import core, {
+  AccountRole,
   SortingOrder,
   toIdMap,
   type ApplyOperations,
@@ -33,7 +34,9 @@ import core, {
   type TxCreateDoc,
   type TxOperations,
   type TxResult,
-  type TxUpdateDoc
+  type TxUpdateDoc,
+  getCurrentAccount,
+  type WithLookup
 } from '@hcengineering/core'
 import { type IntlString } from '@hcengineering/platform'
 import { createQuery, getClient, onClient } from '@hcengineering/presentation'
@@ -274,6 +277,30 @@ export async function moveIssuesToAnotherMilestone (
   }
 }
 
+export async function canEditIssue (issue?: Issue | WithLookup<Issue>): Promise<boolean> {
+  const client = getClient()
+  if (issue === undefined) return false
+
+  const account = getCurrentAccount()
+  const isGuest =
+    account.role === AccountRole.Guest ||
+    account.role === AccountRole.DocGuest ||
+    account.role === AccountRole.ReadOnlyGuest
+
+  if (!isGuest) return true
+
+  const isCreator =
+    issue.createdBy !== undefined && Array.isArray(account.socialIds) && account.socialIds.includes(issue.createdBy)
+
+  if (isCreator) return true
+
+  const collaborator = await client.findOne(core.class.Collaborator, {
+    attachedTo: issue._id,
+    collaborator: account.uuid
+  })
+  if (collaborator !== undefined) return true
+}
+
 export function getTimeReportDate (type: TimeReportDayType): number {
   const date = new Date(Date.now())
 

From cb8ae597863fd54eef4393fafc58685c7a750521 Mon Sep 17 00:00:00 2001
From: Artem Savchenko <armisav@gmail.com>
Date: Fri, 6 Mar 2026 19:57:35 +0700
Subject: [PATCH 2/2] Fix validation

Signed-off-by: Artem Savchenko <armisav@gmail.com>
---
 plugins/tracker-resources/src/utils.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/plugins/tracker-resources/src/utils.ts b/plugins/tracker-resources/src/utils.ts
index 65528eab279..c0afa1ed7bc 100644
--- a/plugins/tracker-resources/src/utils.ts
+++ b/plugins/tracker-resources/src/utils.ts
@@ -298,7 +298,7 @@ export async function canEditIssue (issue?: Issue | WithLookup<Issue>): Promise<
     attachedTo: issue._id,
     collaborator: account.uuid
   })
-  if (collaborator !== undefined) return true
+  return collaborator !== undefined
 }
 
 export function getTimeReportDate (type: TimeReportDayType): number {