From 8e52618a50d1ee6f3aa64d12233e08ee82e17169 Mon Sep 17 00:00:00 2001
From: NW <nw@softuniq.eu>
Date: Tue, 23 Jun 2026 13:23:59 +0100
Subject: [PATCH] fix: make commission settings and wallets read-only for shop
 admin
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Commission Settings card: disabled inputs, Platform Owner badge
- Commission Wallets card: disabled inputs, Platform Owner badge
- Hidden fields carry original values so POST preserves them unchanged
- Shop admin sees values but cannot modify — only platform owner can
---
 src/admin/public/style.css  | 28 ++++++++++++++++++++++++++++
 src/admin/views/settings.js | 31 ++++++++++++++++++++-----------
 2 files changed, 48 insertions(+), 11 deletions(-)

diff --git a/src/admin/public/style.css b/src/admin/public/style.css
index 1cb511b..2232514 100644
--- a/src/admin/public/style.css
+++ b/src/admin/public/style.css
@@ -125,6 +125,34 @@ tr:hover td { background: #f9fafb; }
 .btn-secondary { background: var(--muted); }
 .btn-secondary:hover { background: #555; }
 
+.settings-readonly {
+  border-color: #d1d5db;
+  background: #f9fafb;
+}
+
+.settings-readonly input[disabled] {
+  background: #f3f4f6;
+  color: #6b7280;
+  cursor: not-allowed;
+  border-color: #d1d5db;
+}
+
+.settings-readonly input[disabled]:hover {
+  background: #f3f4f6;
+}
+
+.readonly-badge {
+  display: inline-block;
+  font-size: 0.7rem;
+  font-weight: 600;
+  padding: 0.15rem 0.4rem;
+  border-radius: 999px;
+  background: #fee2e2;
+  color: #b91c1c;
+  vertical-align: middle;
+  margin-left: 0.5rem;
+}
+
 .form, .inline-form {
   display: flex;
   flex-direction: column;
diff --git a/src/admin/views/settings.js b/src/admin/views/settings.js
index fde0729..b2680cd 100644
--- a/src/admin/views/settings.js
+++ b/src/admin/views/settings.js
@@ -27,31 +27,33 @@ export function renderSettings(data) {
           </div>
         </div>
 
-        <div class="detail-card">
-          <h2>Commission Settings</h2>
+        <div class="detail-card settings-readonly">
+          <h2>Commission Settings <span class="readonly-badge">Platform Owner</span></h2>
+          <p class="muted">Set by the platform owner. Contact them to change commission rate.</p>
           <div class="form">
             <label class="checkbox-label">
-              <input type="checkbox" name="COMMISSION_ENABLED" value="true" ${data.commissionEnabled ? 'checked' : ''}>
+              <input type="checkbox" name="COMMISSION_ENABLED" value="true" ${data.commissionEnabled ? 'checked' : ''} disabled>
               Commission Enabled
             </label>
             <label>Commission Percent</label>
-            <input type="number" name="COMMISSION_PERCENT" value="${data.commissionPercent}" min="0" max="100" step="0.1">
+            <input type="number" name="COMMISSION_PERCENT_DISPLAY" value="${data.commissionPercent}" min="0" max="100" step="0.1" disabled>
           </div>
         </div>
 
-        <div class="detail-card">
-          <h2>Commission Wallets</h2>
+        <div class="detail-card settings-readonly">
+          <h2>Commission Wallets <span class="readonly-badge">Platform Owner</span></h2>
+          <p class="muted">These wallets receive commission payments. Set by the platform owner.</p>
           <div class="form">
             <label>BTC</label>
-            <input type="text" name="COMMISSION_WALLET_BTC" value="${escapeHtml(data.commissionWallets.BTC)}">
+            <input type="text" name="COMMISSION_WALLET_BTC_DISPLAY" value="${escapeHtml(data.commissionWallets.BTC)}" disabled>
             <label>LTC</label>
-            <input type="text" name="COMMISSION_WALLET_LTC" value="${escapeHtml(data.commissionWallets.LTC)}">
+            <input type="text" name="COMMISSION_WALLET_LTC_DISPLAY" value="${escapeHtml(data.commissionWallets.LTC)}" disabled>
             <label>USDT</label>
-            <input type="text" name="COMMISSION_WALLET_USDT" value="${escapeHtml(data.commissionWallets.USDT)}">
+            <input type="text" name="COMMISSION_WALLET_USDT_DISPLAY" value="${escapeHtml(data.commissionWallets.USDT)}" disabled>
             <label>USDC</label>
-            <input type="text" name="COMMISSION_WALLET_USDC" value="${escapeHtml(data.commissionWallets.USDC)}">
+            <input type="text" name="COMMISSION_WALLET_USDC_DISPLAY" value="${escapeHtml(data.commissionWallets.USDC)}" disabled>
             <label>ETH</label>
-            <input type="text" name="COMMISSION_WALLET_ETH" value="${escapeHtml(data.commissionWallets.ETH)}">
+            <input type="text" name="COMMISSION_WALLET_ETH_DISPLAY" value="${escapeHtml(data.commissionWallets.ETH)}" disabled>
           </div>
         </div>
 
@@ -85,6 +87,13 @@ export function renderSettings(data) {
       <input type="hidden" name="ADMIN_URL" value="${escapeHtml(data.adminUrl)}">
       <input type="hidden" name="CATALOG_PATH" value="${escapeHtml(data.catalogPath)}">
       <input type="hidden" name="GITEA_API_URL" value="${escapeHtml(data.giteaApiUrl)}">
+      <input type="hidden" name="COMMISSION_ENABLED" value="${data.commissionEnabled ? 'true' : 'false'}">
+      <input type="hidden" name="COMMISSION_PERCENT" value="${data.commissionPercent}">
+      <input type="hidden" name="COMMISSION_WALLET_BTC" value="${escapeHtml(data.commissionWallets.BTC)}">
+      <input type="hidden" name="COMMISSION_WALLET_LTC" value="${escapeHtml(data.commissionWallets.LTC)}">
+      <input type="hidden" name="COMMISSION_WALLET_USDT" value="${escapeHtml(data.commissionWallets.USDT)}">
+      <input type="hidden" name="COMMISSION_WALLET_USDC" value="${escapeHtml(data.commissionWallets.USDC)}">
+      <input type="hidden" name="COMMISSION_WALLET_ETH" value="${escapeHtml(data.commissionWallets.ETH)}">
 
       <div style="margin-top: 1rem;">
         <button type="submit" class="btn btn-success">Save Settings &amp; Restart</button>