feat(demo): make Settings read-only for the demo account

[gianniskotsas]

Summary

Demo users can now view every Settings panel but cannot change anything. The Bank Connections tab — previously hidden for demo — is now shown read-only, per request ("access every setting as they do now, but prevent them from making changes").

Security (the real lockdown — server-enforced)

Added demo guards (isDemoRestrictedUserEmail / new isDemoRestrictedSession() helper → DEMO_RESTRICTED_ACTION_ERROR) to the 9 previously-unguarded mutations:

• lib/actions/settings.ts: updateUserProfile, deleteAllTransactionsAndResetBalances
• lib/actions/categories.ts: createCategory, updateCategory, deleteCategoryWithReassignment
• lib/actions/api-keys.ts: deleteApiKey
• app/api/people/route.ts (POST) and app/api/people/[id]/route.ts (PATCH, DELETE) — return 403 for demo

GET/read paths are untouched, so everything stays viewable.

UX (disabled controls + "read-only" notice)

• New DemoReadOnlyNotice banner shown on each panel for demo.
• ProfileEditor: name input, photo upload, and Save disabled (ProfilePhotoUpload gains a disabled prop).
• CategoryManager: Add button hidden, row Edit/Delete hidden (CategoryRow gains readOnly).
• Household / PeopleList: Add/Edit/Delete hidden.
• BankConnectionsManager: un-hidden; Connect disabled, per-connection Sync/Fix Categories/Disconnect hidden.
• settings-tabs.tsx: Bank Connections tab always rendered; isDemoUser threaded through.

Notes

• API-key create was already hidden for demo (canCreateApiKeys); delete is now server-guarded (button still visible — minor follow-up to hide it).
• Existing demo guards (bank actions, CSV revert, API-key create) were already present and are unchanged.

Test plan

• pnpm exec tsc --noEmit / pnpm lint in an installed checkout (couldn't run here — worktree has no node_modules).
• As the demo account: every Settings tab is viewable incl. Bank Connections; no Save/Add/Edit/Delete/Connect controls are actionable; read-only banner shows.
• As a normal account: Settings behave exactly as before.
• Verify server guards: direct calls to the guarded actions/routes as demo return the demo error / 403.

🤖 Generated with Claude Code

---

Summary by cubic

Makes all Settings read-only for the demo account and un-hides Bank Connections. Previously demo users had partial client-only guards and the Bank Connections tab was hidden; now they can view every panel while every mutation is disabled in the UI and blocked server-side.

• Server guards now block: profile update, delete-all-data, categories create/update/delete, API key delete, and /api/people POST/PATCH/DELETE (403 with DEMO_RESTRICTED_ACTION_ERROR). Adds isDemoRestrictedSession() for consistent checks.
• UI read-only state: shows DemoReadOnlyNotice and disables or hides mutating controls across Profile (name, photo upload; ProfilePhotoUpload gains disabled), Categories (CategoryRow gains readOnly; Add/Edit/Delete hidden), Household (PeopleList gets readOnly), and Bank Connections (tab always visible; Connect disabled; Sync/Recategorize/Disconnect hidden).
• Props threading: isDemoUser passed from SettingsTabs into ProfileEditor, CategoryManager, BankConnectionsManager, and HouseholdTab (which passes to PeopleList).
• Non-demo behavior is unchanged; read endpoints remain intact for all users.

^{Written for commit 3bdd9ef. Summary will update on new commits.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
syllogic	Ready	Preview	Aug 17, 2026 6:49pm

[cubic-dev-ai]

No issues found across 15 files

_{Re-trigger cubic}