[Story-1073] Record-level access UI: hide unassigned, 404 deep links, gate clients + creation

Story 1073Epic None20 files · +525/−36

PR #252 · pramaan-io/pramaan-app · merged 2026-06-08

Why this matters

A member logs in. The Clients tab glows. The Create button shines. Neither is theirs to use.

Record-level access UI

Two doors left wide open.

The fix — Hide what you can't reach, 404 what you shouldn't see, guard every door.

How it flows

sequenceDiagram
  autonumber
  participant member as Member
  participant rail as Nav rail
  participant guard as Route guard
  participant gw as Gateway
  member->>rail: opens app
  rail->>rail: hides Clients directory
  member-->>guard: bookmark /clients/abc
  guard->>guard: assertCanBrowseClients + fetch
  guard->>member: orNotFound() clean 404

Files changed (20)

File	±
`docs/walkthroughs/story-1073-walkthrough.html`	+276
`src/app/[locale]/(workspace)/clients/[clientId]/page.tsx`	+4 −2
`src/app/[locale]/(workspace)/clients/new/page.tsx`	+3
`src/app/[locale]/(workspace)/clients/page.test.tsx`	+1
`src/app/[locale]/(workspace)/clients/page.tsx`	+2 −1
`src/app/[locale]/(workspace)/layout.tsx`	+9 −1
`src/app/[locale]/(workspace)/matters/[matterId]/documents/page.tsx`	+8 −5
`src/app/[locale]/(workspace)/matters/[matterId]/page.tsx`	+10 −7
`src/app/[locale]/(workspace)/matters/page.tsx`	+11 −1
`src/components/app-chrome.tsx`	+8
`src/components/matters/live-matters-list-page.tsx`	+21 −10
`src/components/matters/matters-empty-state.tsx`	+7 −4
`src/components/shared/global-rail-item.tsx`	+6
`src/components/shared/global-rail.test.tsx`	+17
`src/components/shared/global-rail.tsx`	+20 −4
`src/lib/app-me-routing.ts`	+14 −1
`src/lib/app-me.test.ts`	+15
`src/lib/app-me.ts` ★	+31
`src/lib/gateway-not-found.test.ts` ★	+37
`src/lib/gateway-not-found.ts` ★	+25