From dbd3e1a8e378c67eaae1c5295eb7c415efd8269f Mon Sep 17 00:00:00 2001
From: Michael Wedl <michael@syslifters.com>
Date: Thu, 14 Dec 2023 09:53:23 +0100
Subject: [PATCH 1/3] Hide private designs if disabled on instance

---
 .../components/Design/CreateDesignDialog.vue  | 33 ++++---
 .../components/Design/ImportDesignDialog.vue  | 96 ++++---------------
 frontend/src/pages/designs/index.vue          |  7 +-
 frontend/src/pages/designs/private.vue        |  7 +-
 4 files changed, 45 insertions(+), 98 deletions(-)

diff --git a/frontend/src/components/Design/CreateDesignDialog.vue b/frontend/src/components/Design/CreateDesignDialog.vue
index 1933cab6f..f49bb4fb6 100644
--- a/frontend/src/components/Design/CreateDesignDialog.vue
+++ b/frontend/src/components/Design/CreateDesignDialog.vue
@@ -18,12 +18,6 @@
           :required="false"
           autofocus
         />
-        <s-select 
-          v-model="currentScope"
-          :items="scopeItems"
-          label="Scope"
-          class="mt-4"
-        />
       </v-card-text>
 
       <v-card-actions>
@@ -52,23 +46,28 @@
 <script setup lang="ts">
 import { ProjectTypeScope } from "~/utils/types";
 
+const props = withDefaults(defineProps<{
+  projectTypeScope: ProjectTypeScope
+}>(), {
+  projectTypeScope: ProjectTypeScope.GLOBAL
+});
+
 const auth = useAuth();
 const projectTypeStore = useProjectTypeStore();
 
+const canCreate = computed(() => {
+  if (props.projectTypeScope === ProjectTypeScope.GLOBAL) {
+    return auth.permissions.designer;
+  } else {
+    return auth.permissions.private_designs;
+  }
+});
+
 const dialogVisible = ref(false);
 const currentDesign = ref<ProjectType|null>(null);
 const actionInProgress = ref(false);
 watch(actionInProgress, () => { currentDesign.value = null });
 
-const scopeItems = computed(() => {
-  return [
-    { value: ProjectTypeScope.GLOBAL, title: 'Global Design', props: { subtitle: 'Available for all users', disabled: !auth.permissions.designer } },
-    { value: ProjectTypeScope.PRIVATE, title: 'Private Design', props: { subtitle: 'Available only for you', disabled: !auth.permissions.private_designs } },
-  ];
-});
-const currentScope = ref<ProjectTypeScope>(scopeItems.value.find(item => !item.props.disabled)?.value || ProjectTypeScope.GLOBAL);
-const canCreate = computed(() => scopeItems.value.some(item => !item.props.disabled));
-
 async function actionWrapper(action: () => Promise<ProjectType>) {
   if (actionInProgress.value) {
     return;
@@ -89,7 +88,7 @@ async function actionWrapper(action: () => Promise<ProjectType>) {
 async function createEmptyDesign() {
   return await actionWrapper(async () => {
     return await projectTypeStore.create({
-      scope: currentScope.value,
+      scope: props.projectTypeScope,
       name: 'New Design',
     } as ProjectType);
   })
@@ -99,7 +98,7 @@ async function copyDesign() {
   return await actionWrapper(async () => {
     return await projectTypeStore.copy({
       id: currentDesign.value!.id,
-      scope: currentScope.value,
+      scope: props.projectTypeScope,
     });
   })
 }
diff --git a/frontend/src/components/Design/ImportDesignDialog.vue b/frontend/src/components/Design/ImportDesignDialog.vue
index 96e6cbc94..49a85c3fc 100644
--- a/frontend/src/components/Design/ImportDesignDialog.vue
+++ b/frontend/src/components/Design/ImportDesignDialog.vue
@@ -1,87 +1,33 @@
 <template>
-  <span>
-    <btn-import 
-      ref="importBtnRef"
-      :import="startImport" 
-      :loading="actionInProgress"
-      :disabled="!canImport"
-      class="ml-1 mr-1" 
-    />
-
-    <s-dialog v-model="dialogVisible">
-      <template #title>Import Design</template>
-      <template #default>
-        <v-card-text>
-          <s-text-field
-            :model-value="currentFile?.name"
-            label="File"
-            prepend-inner-icon="mdi-file"
-            disabled
-          />
-
-          <s-select 
-            v-model="currentScope"
-            :items="scopeItems"
-            label="Scope"
-            class="mt-4"
-          />
-        </v-card-text>
-        <v-card-actions>
-          <v-spacer />
-          <s-btn-other
-            @click="dialogVisible = false"
-            text="Cancel"
-          />
-          <s-btn-primary 
-            @click="performImport"
-            :loading="actionInProgress"
-            prepend-icon="mdi-upload"
-            text="Import"
-          />
-        </v-card-actions>
-      </template>
-    </s-dialog>
-  </span>
+  <btn-import 
+    ref="importBtnRef"
+    :import="performImport" 
+    :disabled="!canImport"
+    class="ml-1 mr-1" 
+  />
 </template>
 
 <script setup lang="ts">
 import { ProjectTypeScope } from "~/utils/types";
 
-const auth = useAuth();
-
-const scopeItems = computed(() => {
-  return [
-    { value: ProjectTypeScope.GLOBAL, title: 'Global Design', props: { subtitle: 'Available for all users', disabled: !auth.permissions.designer } },
-    { value: ProjectTypeScope.PRIVATE, title: 'Private Design', props: { subtitle: 'Available only for you', disabled: !auth.permissions.private_designs } },
-  ];
+const props = withDefaults(defineProps<{
+  projectTypeScope: ProjectTypeScope
+}>(), {
+  projectTypeScope: ProjectTypeScope.GLOBAL
 });
-const currentScope = ref<ProjectTypeScope>(scopeItems.value.find(item => !item.props.disabled)?.value || ProjectTypeScope.GLOBAL);
-const canImport = computed(() => scopeItems.value.some(item => !item.props.disabled));
-
-const currentFile = ref<File|null>(null);
-const dialogVisible = ref(false);
-const actionInProgress = ref(false);
 
-function startImport(file: File) {
-  currentFile.value = file;
-  dialogVisible.value = true;
-}
-
-async function performImport() {
-  try {
-    actionInProgress.value = true;
-    const designs = await uploadFileHelper<ProjectType[]>('/api/v1/projecttypes/import/', currentFile.value!, { scope: currentScope.value });
-    await navigateTo(`/designs/${designs[0].id}/`)
-  } catch (error: any) {
-    let message = 'Import failed';
-    if (error?.status === 400 && error?.data?.format) {
-      message += ': ' + error.data.format[0];
-    }
-    requestErrorToast({ error, message });
-  } finally {
-    dialogVisible.value = false;
-    actionInProgress.value = false;
+const auth = useAuth();
+const canImport = computed(() => {
+  if (props.projectTypeScope === ProjectTypeScope.GLOBAL) {
+    return auth.permissions.designer;
+  } else {
+    return auth.permissions.private_designs;
   }
+});
+
+async function performImport(file: File) {
+  const designs = await uploadFileHelper<ProjectType[]>('/api/v1/projecttypes/import/', file, { scope: props.projectTypeScope });
+  await navigateTo(`/designs/${designs[0].id}/`)
 }
 
 const importBtnRef = ref();
diff --git a/frontend/src/pages/designs/index.vue b/frontend/src/pages/designs/index.vue
index d940cacb5..37aae28fa 100644
--- a/frontend/src/pages/designs/index.vue
+++ b/frontend/src/pages/designs/index.vue
@@ -3,10 +3,10 @@
     <list-view url="/api/v1/projecttypes/?scope=global&ordering=name">
       <template #title>Designs</template>
       <template #actions>
-        <design-create-design-dialog />
-        <design-import-design-dialog ref="importBtnRef" />
+        <design-create-design-dialog :project-type-scope="ProjectTypeScope.GLOBAL" />
+        <design-import-design-dialog ref="importBtnRef" :project-type-scope="ProjectTypeScope.GLOBAL" />
       </template>
-      <template #tabs>
+      <template #tabs v-if="apiSettings.settings!.features.private_designs">
         <v-tab :to="{ path: '/designs/', query: route.query }" exact prepend-icon="mdi-earth" text="Global Designs" />
         <v-tab :to="{ path: '/designs/private/', query: route.query }" prepend-icon="mdi-account" text="Private Designs" />
       </template>
@@ -27,6 +27,7 @@ useHeadExtended({
 });
 
 const route = useRoute();
+const apiSettings = useApiSettings();
 
 const importBtnRef = ref();
 </script>
diff --git a/frontend/src/pages/designs/private.vue b/frontend/src/pages/designs/private.vue
index 5dbf4c40d..78bbd1810 100644
--- a/frontend/src/pages/designs/private.vue
+++ b/frontend/src/pages/designs/private.vue
@@ -3,10 +3,10 @@
     <list-view url="/api/v1/projecttypes/?scope=private&ordering=name">
       <template #title>Designs</template>
       <template #actions>
-        <design-create-design-dialog />
-        <design-import-design-dialog ref="importBtnRef" />
+        <design-create-design-dialog :project-type-scope="ProjectTypeScope.PRIVATE" />
+        <design-import-design-dialog ref="importBtnRef" :project-type-scope="ProjectTypeScope.PRIVATE" />
       </template>
-      <template #tabs>
+      <template #tabs v-if="apiSettings.settings!.features.private_designs">
         <v-tab :to="{ path: '/designs/', query: route.query }" exact prepend-icon="mdi-earth" text="Global Designs" />
         <v-tab :to="{ path: '/designs/private/', query: route.query }" prepend-icon="mdi-account" text="Private Designs" />
       </template>
@@ -27,6 +27,7 @@ useHeadExtended({
 });
 
 const route = useRoute();
+const apiSettings = useApiSettings();
 
 const importBtnRef = ref();
 </script>

From eca27d0e94b753a11b637cceaa0b4f199e7d260e Mon Sep 17 00:00:00 2001
From: Michael Wedl <michael@syslifters.com>
Date: Thu, 14 Dec 2023 10:02:00 +0100
Subject: [PATCH 2/3] Fix auth.permissions not reactive

---
 frontend/src/components/Design/CreateDesignDialog.vue  |  4 ++--
 frontend/src/components/Design/ImportDesignDialog.vue  |  4 ++--
 frontend/src/components/LicenseInfoMenuItem.vue        |  4 ++--
 frontend/src/components/UserInfoForm.vue               |  6 +++---
 frontend/src/components/UserInfoMenuItem.vue           |  4 ++--
 frontend/src/composables/auth.ts                       |  2 +-
 frontend/src/composables/lockedit.ts                   |  4 ++--
 frontend/src/layouts/default.vue                       |  6 +++---
 frontend/src/pages/designs/[projectTypeId]/index.vue   |  2 +-
 frontend/src/pages/projects/[projectId]/index.vue      | 10 +++++-----
 frontend/src/pages/projects/[projectId]/publish.vue    |  4 ++--
 .../reporting/findings/[findingId]/index.vue           |  2 +-
 frontend/src/pages/projects/index.vue                  |  4 ++--
 frontend/src/pages/templates/[templateId]/index.vue    |  4 ++--
 frontend/src/pages/templates/index.vue                 |  4 ++--
 frontend/src/pages/users/[userId]/identities.vue       |  2 +-
 frontend/src/pages/users/[userId]/index.vue            |  2 +-
 frontend/src/pages/users/[userId]/mfa.vue              |  2 +-
 frontend/src/pages/users/[userId]/reset-password.vue   |  2 +-
 frontend/src/pages/users/index.vue                     |  2 +-
 20 files changed, 37 insertions(+), 37 deletions(-)

diff --git a/frontend/src/components/Design/CreateDesignDialog.vue b/frontend/src/components/Design/CreateDesignDialog.vue
index f49bb4fb6..a3903368a 100644
--- a/frontend/src/components/Design/CreateDesignDialog.vue
+++ b/frontend/src/components/Design/CreateDesignDialog.vue
@@ -57,9 +57,9 @@ const projectTypeStore = useProjectTypeStore();
 
 const canCreate = computed(() => {
   if (props.projectTypeScope === ProjectTypeScope.GLOBAL) {
-    return auth.permissions.designer;
+    return auth.permissions.value.designer;
   } else {
-    return auth.permissions.private_designs;
+    return auth.permissions.value.private_designs;
   }
 });
 
diff --git a/frontend/src/components/Design/ImportDesignDialog.vue b/frontend/src/components/Design/ImportDesignDialog.vue
index 49a85c3fc..2677e3d05 100644
--- a/frontend/src/components/Design/ImportDesignDialog.vue
+++ b/frontend/src/components/Design/ImportDesignDialog.vue
@@ -19,9 +19,9 @@ const props = withDefaults(defineProps<{
 const auth = useAuth();
 const canImport = computed(() => {
   if (props.projectTypeScope === ProjectTypeScope.GLOBAL) {
-    return auth.permissions.designer;
+    return auth.permissions.value.designer;
   } else {
-    return auth.permissions.private_designs;
+    return auth.permissions.value.private_designs;
   }
 });
 
diff --git a/frontend/src/components/LicenseInfoMenuItem.vue b/frontend/src/components/LicenseInfoMenuItem.vue
index ed0efa118..2fd5ea238 100644
--- a/frontend/src/components/LicenseInfoMenuItem.vue
+++ b/frontend/src/components/LicenseInfoMenuItem.vue
@@ -1,5 +1,5 @@
 <template>
-  <v-list-item to="/license/" title="License" :disabled="!auth.permissions.view_license">
+  <v-list-item to="/license/" title="License" :disabled="!auth.permissions.value.view_license">
     <template #prepend>
       <v-badge :color="licenseError ? 'error' : licenseWarning ? 'warning' : 'transparent'" dot>
         <v-icon icon="mdi-check-decagram" />
@@ -14,7 +14,7 @@ const apiSettings = useApiSettings();
 
 const licenseError = computed(() => apiSettings.settings!.license.error !== null);
 const { data: licenseInfo } = useLazyAsyncData(async () => {
-  if (auth.permissions.view_license && licenseError.value) {
+  if (auth.permissions.value.view_license && licenseError.value) {
     await nextTick();
     return await $fetch<LicenseInfoDetails>('/api/v1/utils/license/', { method: 'GET' });
   } else {
diff --git a/frontend/src/components/UserInfoForm.vue b/frontend/src/components/UserInfoForm.vue
index c6dc7bce4..d72e853e6 100644
--- a/frontend/src/components/UserInfoForm.vue
+++ b/frontend/src/components/UserInfoForm.vue
@@ -188,9 +188,9 @@ const user = computed(() => props.modelValue);
 
 const auth = useAuth();
 const apiSettings = useApiSettings();
-const canEdit = computed(() => (auth.permissions.user_manager && !user.value.is_system_user) || user.value.id === auth.user.value!.id);
-const canEditGeneralPermissions = computed(() => canEdit.value && props.canEditPermissions && auth.permissions.user_manager && apiSettings.settings!.features.permissions);
-const canEditSuperuserPermissions = computed(() => canEdit.value && props.canEditPermissions && auth.permissions.user_manager && auth.permissions.admin);
+const canEdit = computed(() => (auth.permissions.value.user_manager && !user.value.is_system_user) || user.value.id === auth.user.value!.id);
+const canEditGeneralPermissions = computed(() => canEdit.value && props.canEditPermissions && auth.permissions.value.user_manager && apiSettings.settings!.features.permissions);
+const canEditSuperuserPermissions = computed(() => canEdit.value && props.canEditPermissions && auth.permissions.value.user_manager && auth.permissions.value.admin);
 
 const rules = {
   required: [(v: any) => !!v || 'This field is required!'],
diff --git a/frontend/src/components/UserInfoMenuItem.vue b/frontend/src/components/UserInfoMenuItem.vue
index 65f1b88b9..2b5cc9408 100644
--- a/frontend/src/components/UserInfoMenuItem.vue
+++ b/frontend/src/components/UserInfoMenuItem.vue
@@ -17,13 +17,13 @@
         />
         <template v-if="apiSettings.isProfessionalLicense">
           <v-list-item
-            v-if="auth.permissions.admin"
+            v-if="auth.permissions.value.admin"
             :to="{path: '/users/self/admin/disable/', query: { next: route.fullPath }}"
             prepend-icon="mdi-account-arrow-down"
             title="Disable Superuser Permissions"
           />
           <v-list-item
-            v-else-if="auth.permissions.superuser"
+            v-else-if="auth.permissions.value.superuser"
             :to="{path: '/users/self/admin/enable/', query: { next: route.fullPath }}"
             prepend-icon="mdi-account-arrow-up"
             title="Enable Superuser Permissions"
diff --git a/frontend/src/composables/auth.ts b/frontend/src/composables/auth.ts
index c62c591f7..4bb18af0f 100644
--- a/frontend/src/composables/auth.ts
+++ b/frontend/src/composables/auth.ts
@@ -118,7 +118,7 @@ export function useAuth() {
     loggedIn,
     user,
     store,
-    permissions: store.permissions,
+    permissions: computed(() => store.permissions),
     logout,
     redirect,
     redirectToReAuth,
diff --git a/frontend/src/composables/lockedit.ts b/frontend/src/composables/lockedit.ts
index 850ad310c..edfa38601 100644
--- a/frontend/src/composables/lockedit.ts
+++ b/frontend/src/composables/lockedit.ts
@@ -184,8 +184,8 @@ export function useProjectTypeLockEdit(options: {
   });
 
   const hasEditPermissions = computed(() => {
-    return (projectType.value.scope === ProjectTypeScope.GLOBAL && auth.permissions.designer) ||
-             (projectType.value.scope === ProjectTypeScope.PRIVATE && auth.permissions.private_designs) ||
+    return (projectType.value.scope === ProjectTypeScope.GLOBAL && auth.permissions.value.designer) ||
+             (projectType.value.scope === ProjectTypeScope.PRIVATE && auth.permissions.value.private_designs) ||
              (projectType.value.scope === ProjectTypeScope.PROJECT && projectType.value.source === SourceEnum.CUSTOMIZED);
   });
   const errorMessage = computed(() => {
diff --git a/frontend/src/layouts/default.vue b/frontend/src/layouts/default.vue
index ef1eb8c06..96959abb3 100644
--- a/frontend/src/layouts/default.vue
+++ b/frontend/src/layouts/default.vue
@@ -48,13 +48,13 @@
         <v-list-item to="/designs/" title="Designs" prepend-icon="mdi-pencil-ruler" :active="route.path.startsWith('/designs')" />
         <v-list-item to="/notes/personal/" title="Notes" prepend-icon="mdi-notebook" :active="route.path.startsWith('/notes')" />
         
-        <template v-if="auth.permissions.superuser || auth.permissions.user_manager || auth.permissions.view_license">
+        <template v-if="auth.permissions.value.superuser || auth.permissions.value.user_manager || auth.permissions.value.view_license">
           <v-list-item class="mt-6 pa-0" min-height="0">
             <v-list-subheader title="Administration" />
             <template #append>
               <template v-if="apiSettings.isProfessionalLicense">
                 <s-btn-icon
-                  v-if="auth.permissions.admin"
+                  v-if="auth.permissions.value.admin"
                   :to="{path: '/users/self/admin/disable/', query: { next: route.fullPath }}"
                   density="comfortable"
                 >
@@ -79,7 +79,7 @@
             title="Users" 
             prepend-icon="mdi-account-multiple" 
             :active="route.path.startsWith('/users') && !route.path.startsWith('/users/self')"
-            :disabled="!auth.permissions.user_manager" 
+            :disabled="!auth.permissions.value.user_manager" 
           />
           <license-info-menu-item />
         </template>
diff --git a/frontend/src/pages/designs/[projectTypeId]/index.vue b/frontend/src/pages/designs/[projectTypeId]/index.vue
index 8783e5045..3e1e2e502 100644
--- a/frontend/src/pages/designs/[projectTypeId]/index.vue
+++ b/frontend/src/pages/designs/[projectTypeId]/index.vue
@@ -4,7 +4,7 @@
       <edit-toolbar v-bind="toolbarAttrs" :form="$refs.form">
         <template #context-menu>
           <btn-copy
-            :disabled="!auth.permissions.designer"
+            :disabled="!auth.permissions.value.designer"
             :copy="performCopy"
           />
           <btn-export
diff --git a/frontend/src/pages/projects/[projectId]/index.vue b/frontend/src/pages/projects/[projectId]/index.vue
index 201c2e9d3..017f179d5 100644
--- a/frontend/src/pages/projects/[projectId]/index.vue
+++ b/frontend/src/pages/projects/[projectId]/index.vue
@@ -7,12 +7,12 @@
           <btn-readonly 
             :value="project.readonly" 
             :set-readonly="setReadonly" 
-            :disabled="!auth.permissions.update_project_settings"
+            :disabled="!auth.permissions.value.update_project_settings"
             class="ml-1 mr-1" 
           />
           <s-btn-secondary
             v-if="project.readonly"
-            :disabled="!auth.permissions.archive_projects"
+            :disabled="!auth.permissions.value.archive_projects"
             :to="`/projects/${project.id}/archive/`"
             class="mr-1"
             prepend-icon="mdi-folder-lock-outline"
@@ -25,7 +25,7 @@
           <btn-copy
             :copy="performCopy"
             confirm-text="The whole project will be copied including all members, sections, findings and images."
-            :disabled="!auth.permissions.create_projects"
+            :disabled="!auth.permissions.value.create_projects"
           />
           <btn-export
             :export-url="`/api/v1/pentestprojects/${project.id}/export/`"
@@ -159,12 +159,12 @@ const { toolbarAttrs, readonly, editMode } = useLockEdit<PentestProject>({
   hasEditPermissions: computed(() => {
     if (project.value?.readonly) {
       return false;
-    } else if (!auth.permissions.update_project_settings) {
+    } else if (!auth.permissions.value.update_project_settings) {
       return false;
     }
     return true;
   }),
-  canDelete: computed(() => auth.permissions.delete_projects),
+  canDelete: computed(() => auth.permissions.value.delete_projects),
   errorMessage: computed(() => {
     if (project.value?.readonly) {
       return 'This project is finished and cannot be changed anymore. In order to edit this project, re-activate it in the project settings.'
diff --git a/frontend/src/pages/projects/[projectId]/publish.vue b/frontend/src/pages/projects/[projectId]/publish.vue
index ccdbed892..8a7b309bf 100644
--- a/frontend/src/pages/projects/[projectId]/publish.vue
+++ b/frontend/src/pages/projects/[projectId]/publish.vue
@@ -33,7 +33,7 @@
             button-icon="mdi-file-cog"
             tooltip-text="Customize Design for this project"
             dialog-text="Customize the current Design for this project. This allows you to adapt the appearence (HTML, CSS) of the design for this project only. The original design is not affected. Any changes made to the original design will not be automatically applied to the adapted design."
-            :disabled="project.readonly || projectType.source === 'customized' || !auth.permissions.update_project_settings"
+            :disabled="project.readonly || projectType.source === 'customized' || !auth.permissions.value.update_project_settings"
             class="ml-1"
           />
         </div>
@@ -78,7 +78,7 @@
             v-if="!project.readonly"
             :value="project.readonly"
             :set-readonly="setReadonly"
-            :disabled="!canGenerateFinalReport || !auth.permissions.update_project_settings"
+            :disabled="!canGenerateFinalReport || !auth.permissions.value.update_project_settings"
           />
         </div>
       </v-form>
diff --git a/frontend/src/pages/projects/[projectId]/reporting/findings/[findingId]/index.vue b/frontend/src/pages/projects/[projectId]/reporting/findings/[findingId]/index.vue
index bdfc8fcb5..27a26721a 100644
--- a/frontend/src/pages/projects/[projectId]/reporting/findings/[findingId]/index.vue
+++ b/frontend/src/pages/projects/[projectId]/reporting/findings/[findingId]/index.vue
@@ -7,7 +7,7 @@
             :to="{path: '/templates/fromfinding/', query: {project: project.id, finding: finding.id}}"
             prepend-icon="mdi-view-compact"
             title="Save as template"
-            :disabled="!auth.permissions.template_editor"
+            :disabled="!auth.permissions.value.template_editor"
           />
         </template>
 
diff --git a/frontend/src/pages/projects/index.vue b/frontend/src/pages/projects/index.vue
index 00f571a53..f4638b63c 100644
--- a/frontend/src/pages/projects/index.vue
+++ b/frontend/src/pages/projects/index.vue
@@ -3,8 +3,8 @@
     <list-view url="/api/v1/pentestprojects/?readonly=false">
       <template #title>Projects</template>
       <template #actions>
-        <btn-create to="/projects/new/" :disabled="!auth.permissions.create_projects" />
-        <btn-import ref="importBtn" :import="performImport" :disabled="!auth.permissions.import_projects" />
+        <btn-create to="/projects/new/" :disabled="!auth.permissions.value.create_projects" />
+        <btn-import ref="importBtn" :import="performImport" :disabled="!auth.permissions.value.import_projects" />
       </template>
       <template #tabs>
         <v-tab :to="{path: '/projects/', query: route.query}" exact prepend-icon="mdi-file-document" text="Active Projects" />
diff --git a/frontend/src/pages/templates/[templateId]/index.vue b/frontend/src/pages/templates/[templateId]/index.vue
index e27f95d8d..3756d499f 100644
--- a/frontend/src/pages/templates/[templateId]/index.vue
+++ b/frontend/src/pages/templates/[templateId]/index.vue
@@ -21,7 +21,7 @@
             <btn-export
               :export-url="`/api/v1/findingtemplates/${template.id}/export/`"
               :name="`template-` + mainTranslation!.data.title"
-              :disabled="!auth.permissions.template_editor"
+              :disabled="!auth.permissions.value.template_editor"
             />
           </template>
         </template-editor>
@@ -69,7 +69,7 @@ const { toolbarAttrs, fetchLoaderAttrs, readonly } = useLockEdit({
   fetchState,
   baseUrl,
   toolbarRef: computed(() => (vm?.refs?.templateEditor as any)?.toolbarRef),
-  hasEditPermissions: computed(() => auth.permissions.template_editor),
+  hasEditPermissions: computed(() => auth.permissions.value.template_editor),
   performSave: async (data) => {
     const res = await templateStore.update(data!);
     for (const tr of template.value!.translations) {
diff --git a/frontend/src/pages/templates/index.vue b/frontend/src/pages/templates/index.vue
index 61548db43..3148c9b79 100644
--- a/frontend/src/pages/templates/index.vue
+++ b/frontend/src/pages/templates/index.vue
@@ -29,12 +29,12 @@
       <template #actions>
         <btn-create 
           to="/templates/new/" 
-          :disabled="!auth.permissions.template_editor"
+          :disabled="!auth.permissions.value.template_editor"
         />
         <btn-import 
           ref="importBtnRef"
           :import="performImport"
-          :disabled="!auth.permissions.template_editor"
+          :disabled="!auth.permissions.value.template_editor"
         />
       </template>
       <template #item="{item}">
diff --git a/frontend/src/pages/users/[userId]/identities.vue b/frontend/src/pages/users/[userId]/identities.vue
index a0a47bbf9..0bb857d49 100644
--- a/frontend/src/pages/users/[userId]/identities.vue
+++ b/frontend/src/pages/users/[userId]/identities.vue
@@ -80,7 +80,7 @@ const createWizard = ref({
     identifier: '',
   },
 });
-const canEdit = computed(() => auth.permissions.user_manager && !user.value.is_system_user);
+const canEdit = computed(() => auth.permissions.value.user_manager && !user.value.is_system_user);
 
 async function createIdentity() {
   try {
diff --git a/frontend/src/pages/users/[userId]/index.vue b/frontend/src/pages/users/[userId]/index.vue
index 2e4031047..a37fac40e 100644
--- a/frontend/src/pages/users/[userId]/index.vue
+++ b/frontend/src/pages/users/[userId]/index.vue
@@ -65,7 +65,7 @@ const apiUrl = `/api/v1/pentestusers/${route.params.userId}/`
 const user = await useFetchE<User>(apiUrl, { method: 'GET' });
 
 const serverErrors = ref<any|null>(null);
-const canEdit = computed(() => auth.permissions.user_manager && !user.value.is_system_user);
+const canEdit = computed(() => auth.permissions.value.user_manager && !user.value.is_system_user);
 
 async function performSave(data: User) {
   try {
diff --git a/frontend/src/pages/users/[userId]/mfa.vue b/frontend/src/pages/users/[userId]/mfa.vue
index 2574c34d8..e3cc1fc0e 100644
--- a/frontend/src/pages/users/[userId]/mfa.vue
+++ b/frontend/src/pages/users/[userId]/mfa.vue
@@ -37,7 +37,7 @@ const auth = useAuth();
 
 const user = await useFetchE<User>(`/api/v1/pentestusers/${route.params.userId}/`, { method: 'GET' })
 const mfaMethods = await useFetchE<MfaMethod[]>(`/api/v1/pentestusers/${route.params.userId}/mfa/`, { method: 'GET' });
-const canEdit = computed(() => auth.permissions.user_manager && !user.value.is_system_user)
+const canEdit = computed(() => auth.permissions.value.user_manager && !user.value.is_system_user)
 
 async function deleteMfaMethod(mfaMethod: MfaMethod) {
   return await $fetch(`/api/v1/pentestusers/${route.params.userId}/mfa/${mfaMethod.id}/`, { method: 'DELETE' });
diff --git a/frontend/src/pages/users/[userId]/reset-password.vue b/frontend/src/pages/users/[userId]/reset-password.vue
index 8a40eaacd..022d805e9 100644
--- a/frontend/src/pages/users/[userId]/reset-password.vue
+++ b/frontend/src/pages/users/[userId]/reset-password.vue
@@ -35,7 +35,7 @@ const user = await useFetchE<User>(`/api/v1/pentestusers/${route.params.userId}/
 const password = ref(null);
 const serverErrors = ref<any|null>(null);
 
-const canEdit = computed(() => auth.permissions.user_manager && !user.value!.is_system_user);
+const canEdit = computed(() => auth.permissions.value.user_manager && !user.value!.is_system_user);
 
 const form = ref<VForm>();
 async function changePassword() {
diff --git a/frontend/src/pages/users/index.vue b/frontend/src/pages/users/index.vue
index 352b4447f..1c0dac732 100644
--- a/frontend/src/pages/users/index.vue
+++ b/frontend/src/pages/users/index.vue
@@ -4,7 +4,7 @@
     <template #actions>
       <btn-create 
         to="/users/new/" 
-        :disabled="!auth.permissions.user_manager"
+        :disabled="!auth.permissions.value.user_manager"
       />
     </template>
     <template #item="{item: user}: {item: User}">

From 83f9c5b6720b730db7b2b8708ee44b81f4784cf6 Mon Sep 17 00:00:00 2001
From: Michael Wedl <michael@syslifters.com>
Date: Thu, 14 Dec 2023 10:11:46 +0100
Subject: [PATCH 3/3] Remove notes status emoji

---
 CHANGELOG.md                                  |  1 +
 .../archive/import_export/serializers.py      |  3 +--
 ...ojectnotebookpage_status_emoji_and_more.py | 25 +++++++++++++++++++
 .../pentests/models/notes.py                  |  1 -
 .../pentests/serializers/notes.py             |  2 +-
 api/src/reportcreator_api/tests/mock.py       |  2 --
 .../tests/test_import_export.py               |  4 +--
 frontend/src/components/NotesSortableList.vue |  5 ----
 .../src/pages/notes/personal/[noteId].vue     |  7 ------
 .../notes/[noteId]/history/[historyDate].vue  |  6 -----
 .../[projectId]/notes/[noteId]/index.vue      |  7 ------
 frontend/src/utils/types.ts                   |  1 -
 12 files changed, 30 insertions(+), 34 deletions(-)
 create mode 100644 api/src/reportcreator_api/pentests/migrations/0047_remove_historicalprojectnotebookpage_status_emoji_and_more.py

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 68ee8e77d..4120a2fdf 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,7 @@
 * Disable buttons and menu entries when user does not have permissions
 * Fix save error for user fields
 * Ensure custom fonts are loaded before rendering charts and diagrams
+* Remove status emoji of notes
 
 
 ## v2023.145 - 2023-12-11
diff --git a/api/src/reportcreator_api/archive/import_export/serializers.py b/api/src/reportcreator_api/archive/import_export/serializers.py
index e9b258831..07047038e 100644
--- a/api/src/reportcreator_api/archive/import_export/serializers.py
+++ b/api/src/reportcreator_api/archive/import_export/serializers.py
@@ -407,13 +407,12 @@ class Meta:
         model = ProjectNotebookPage
         fields = [
             'id', 'created', 'updated',
-            'title', 'text', 'checked', 'icon_emoji', 'status_emoji', 'assignee',
+            'title', 'text', 'checked', 'icon_emoji', 'assignee',
             'order', 'parent',
         ]
         extra_kwargs = {
             'created': {'read_only': False, 'required': False},
             'icon_emoji': {'required': False},
-            'status_emoji': {'required': False},
             'assignee': {'required': False}
         }
 
diff --git a/api/src/reportcreator_api/pentests/migrations/0047_remove_historicalprojectnotebookpage_status_emoji_and_more.py b/api/src/reportcreator_api/pentests/migrations/0047_remove_historicalprojectnotebookpage_status_emoji_and_more.py
new file mode 100644
index 000000000..82df7dd23
--- /dev/null
+++ b/api/src/reportcreator_api/pentests/migrations/0047_remove_historicalprojectnotebookpage_status_emoji_and_more.py
@@ -0,0 +1,25 @@
+# Generated by Django 4.2.7 on 2023-12-14 09:09
+
+from django.db import migrations
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('pentests', '0046_history_encryption'),
+    ]
+
+    operations = [
+        migrations.RemoveField(
+            model_name='historicalprojectnotebookpage',
+            name='status_emoji',
+        ),
+        migrations.RemoveField(
+            model_name='projectnotebookpage',
+            name='status_emoji',
+        ),
+        migrations.RemoveField(
+            model_name='usernotebookpage',
+            name='status_emoji',
+        ),
+    ]
diff --git a/api/src/reportcreator_api/pentests/models/notes.py b/api/src/reportcreator_api/pentests/models/notes.py
index ac929e9e7..5d3f2ed08 100644
--- a/api/src/reportcreator_api/pentests/models/notes.py
+++ b/api/src/reportcreator_api/pentests/models/notes.py
@@ -18,7 +18,6 @@ class Meta:
     text = EncryptedField(base_field=models.TextField(default=''))
     checked = models.BooleanField(null=True, blank=True)
     icon_emoji = models.CharField(max_length=32, null=True, blank=True)
-    status_emoji = models.CharField(max_length=32, null=True, blank=True)
 
     parent = models.ForeignKey(to='self', on_delete=models.CASCADE, null=True, blank=True)
     order = models.PositiveIntegerField()
diff --git a/api/src/reportcreator_api/pentests/serializers/notes.py b/api/src/reportcreator_api/pentests/serializers/notes.py
index 1166fecff..54f5163b5 100644
--- a/api/src/reportcreator_api/pentests/serializers/notes.py
+++ b/api/src/reportcreator_api/pentests/serializers/notes.py
@@ -17,7 +17,7 @@ class NotebookPageSerializerBase(serializers.ModelSerializer):
     class Meta:
         fields = [
             'id', 'created', 'updated', 'lock_info',
-            'title', 'text', 'checked', 'icon_emoji', 'status_emoji',
+            'title', 'text', 'checked', 'icon_emoji',
             'order', 'parent',
         ]
         extra_kwargs = {
diff --git a/api/src/reportcreator_api/tests/mock.py b/api/src/reportcreator_api/tests/mock.py
index 8114af0c0..e9c581e1f 100644
--- a/api/src/reportcreator_api/tests/mock.py
+++ b/api/src/reportcreator_api/tests/mock.py
@@ -188,7 +188,6 @@ def create_usernotebookpage(**kwargs) -> UserNotebookPage:
         'text': 'Note text',
         'checked': random.choice([None, True, False]),
         'icon_emoji': random.choice([None, '🦖']),
-        'status_emoji': random.choice([None, '✔️', '🤡']),
     } | kwargs)
 
 
@@ -198,7 +197,6 @@ def create_projectnotebookpage(**kwargs) -> ProjectNotebookPage:
         'text': 'Note text',
         'checked': random.choice([None, True, False]),
         'icon_emoji': random.choice([None, '🦖']),
-        'status_emoji': random.choice([None, '✔️', '🤡']),
     } | kwargs)
 
 
diff --git a/api/src/reportcreator_api/tests/test_import_export.py b/api/src/reportcreator_api/tests/test_import_export.py
index bf9c88c1b..67aeadae5 100644
--- a/api/src/reportcreator_api/tests/test_import_export.py
+++ b/api/src/reportcreator_api/tests/test_import_export.py
@@ -175,7 +175,7 @@ def test_export_import_project_all(self):
 
         assert p.notes.count() == self.project.notes.count()
         for i, s in zip(p.notes.order_by('note_id'), self.project.notes.order_by('note_id')):
-            assertKeysEqual(i, s, ['note_id', 'created', 'title', 'text', 'checked', 'icon_emoji', 'status_emoji', 'order'])
+            assertKeysEqual(i, s, ['note_id', 'created', 'title', 'text', 'checked', 'icon_emoji', 'order'])
             assert i.parent.note_id == s.parent.note_id if s.parent else i.parent is None
         assert {(f.name, f.file.read()) for f in p.files.all()} == {(f.name, f.file.read()) for f in self.project.files.all()}
 
@@ -373,7 +373,7 @@ def test_copy_project(self):
         
         for p_n, cp_n in zip(p.notes.order_by('note_id'), cp.notes.order_by('note_id')):
             assert p_n != cp_n
-            assertKeysEqual(p_n, cp_n, ['note_id', 'title', 'text', 'checked', 'icon_emoji', 'status_emoji', 'order'])
+            assertKeysEqual(p_n, cp_n, ['note_id', 'title', 'text', 'checked', 'icon_emoji', 'order'])
             assert not cp_f.is_locked
             if p_n.parent:
                 assert p_n.parent.note_id == cp_n.parent.note_id
diff --git a/frontend/src/components/NotesSortableList.vue b/frontend/src/components/NotesSortableList.vue
index 8ab57bcf3..702aa39e1 100644
--- a/frontend/src/components/NotesSortableList.vue
+++ b/frontend/src/components/NotesSortableList.vue
@@ -40,11 +40,6 @@
               </span>
             </v-list-item-subtitle>
           </template>
-          <template #append>
-            <div v-if="item.note.status_emoji" class="note-icon">
-              <s-emoji :value="item.note.status_emoji" size="small" class="emoji-icon" />
-            </div>
-          </template>
         </v-list-item>
 
         <v-list v-if="isExpanded(item.note)" density="compact" class="pt-0 pb-0">
diff --git a/frontend/src/pages/notes/personal/[noteId].vue b/frontend/src/pages/notes/personal/[noteId].vue
index 4d45ceb70..671eed9fe 100644
--- a/frontend/src/pages/notes/personal/[noteId].vue
+++ b/frontend/src/pages/notes/personal/[noteId].vue
@@ -29,12 +29,6 @@
                 v-bind="inputFieldAttrs"
                 class="note-title"
               />
-              
-              <s-emoji-picker-field
-                v-model="note.status_emoji"
-                :disabled="readonly"
-                density="comfortable"
-              />
             </div>
           </template>
           <template #context-menu>
@@ -81,7 +75,6 @@ const { readonly, toolbarAttrs, fetchLoaderAttrs } = useLockEdit({
   updateInStore: n => userNotesStore.setNote(n!),
   autoSaveOnUpdateData({ oldValue, newValue }): boolean {
     return oldValue!.checked !== newValue!.checked ||
-        oldValue!.status_emoji !== newValue!.status_emoji ||
         oldValue!.icon_emoji !== newValue!.icon_emoji;
   }
 });
diff --git a/frontend/src/pages/projects/[projectId]/notes/[noteId]/history/[historyDate].vue b/frontend/src/pages/projects/[projectId]/notes/[noteId]/history/[historyDate].vue
index b1c2883c7..9cf39980f 100644
--- a/frontend/src/pages/projects/[projectId]/notes/[noteId]/history/[historyDate].vue
+++ b/frontend/src/pages/projects/[projectId]/notes/[noteId]/history/[historyDate].vue
@@ -29,12 +29,6 @@
                 v-bind="inputFieldAttrs"
                 class="note-title"
               />
-              
-              <s-emoji-picker-field
-                v-model="note.status_emoji"
-                :disabled="readonly"
-                density="comfortable"
-              />
             </div>
           </template>
           <template #default>
diff --git a/frontend/src/pages/projects/[projectId]/notes/[noteId]/index.vue b/frontend/src/pages/projects/[projectId]/notes/[noteId]/index.vue
index 37c7c50c4..2fae9d449 100644
--- a/frontend/src/pages/projects/[projectId]/notes/[noteId]/index.vue
+++ b/frontend/src/pages/projects/[projectId]/notes/[noteId]/index.vue
@@ -29,12 +29,6 @@
                 v-bind="inputFieldAttrs"
                 class="note-title"
               />
-              
-              <s-emoji-picker-field
-                v-model="note.status_emoji"
-                :disabled="readonly"
-                density="comfortable"
-              />
             </div>
           </template>
           <template #default>
@@ -100,7 +94,6 @@ const { data: note, project, readonly, toolbarAttrs, fetchLoaderAttrs, inputFiel
   updateInStore: projectStore.setNote,
   autoSaveOnUpdateData({ oldValue, newValue }): boolean {
     return oldValue.checked !== newValue.checked ||
-        oldValue.status_emoji !== newValue.status_emoji ||
         oldValue.icon_emoji !== newValue.icon_emoji ||
         oldValue.assignee?.id !== newValue.assignee?.id;
   }
diff --git a/frontend/src/utils/types.ts b/frontend/src/utils/types.ts
index 4b9397a77..8674b6c21 100644
--- a/frontend/src/utils/types.ts
+++ b/frontend/src/utils/types.ts
@@ -281,7 +281,6 @@ export type UserNote = BaseModel & Lockable & {
   text: string;
   checked: boolean|null;
   icon_emoji: string;
-  status_emoji: string;
 }
 
 export type ProjectNote = UserNote & {