Deploy from markdownfs@6a91df8

src/db.rs

@@ -484,7 +484,7 @@ impl MarkdownDb {
     // ─── Auth helpers ───
 
     pub async fn login(&self, username: &str) -> Result<Session, VfsError> {
-        let mut guard = self.inner.write().await;
+        let guard = self.inner.read().await;
         let uid = guard
             .registry_lookup_uid(username)
             .ok_or_else(|| VfsError::AuthError {

src/server/assets/app.js

@@ -140,7 +140,7 @@ async function refreshWhoAmI() {
     const res = await api("GET", "/auth/whoami");
     const w = await res.json();
     state.user = w;
-    state.isAdmin = w.is_root || (w.groups || []).includes(0);
+    state.isAdmin = w.is_root || w.is_wheel === true;
     $("user-info").hidden = false;
     let label = w.authenticated ? w.username : `${w.username} (anon)`;
     if (w.on_behalf_of) {

src/server/routes_auth.rs

@@ -33,6 +33,7 @@ pub struct WhoAmI {
     pub gid: u32,
     pub groups: Vec<u32>,
     pub is_root: bool,
+    pub is_wheel: bool,
     pub authenticated: bool,
     pub on_behalf_of: Option<String>,
 }
@@ -99,12 +100,15 @@ async fn whoami(State(state): State<AppState>, headers: HeaderMap) -> impl IntoR
         .unwrap_or("");
     let authenticated = auth_header.starts_with("Bearer ") || auth_header.starts_with("User ");
 
+    let (is_wheel, _) = state.db.principal_flags(session.uid).await;
+
     Json(WhoAmI {
         username: session.username.clone(),
         uid: session.uid,
         gid: session.gid,
         groups: session.groups.clone(),
         is_root: session.is_effectively_root(),
+        is_wheel,
         authenticated,
         on_behalf_of: session.delegate.as_ref().map(|d| d.username.clone()),
     })