fix: simplify dashboard and disable unauthorized actions

internal/app/target_test.go

@@ -103,6 +103,35 @@ func TestApplicationRequiresTargetConfirmationBeforeMutation(t *testing.T) {
 	}
 }
 
+type authorityTarget struct {
+	*fakeTarget
+	allowed bool
+	reason  string
+}
+
+func (t *authorityTarget) MutationAuthority(context.Context) target.Check {
+	return target.Check{Name: "mutation authority", OK: t.allowed, Evidence: t.reason}
+}
+
+func TestApplicationDisablesMutationWhenCurrentProcessLacksAuthority(t *testing.T) {
+	adapter := &authorityTarget{fakeTarget: &fakeTarget{available: true, state: target.Disabled}, reason: "requires elevated authority"}
+	application, err := app.NewWithTargets(profile.NewFileStore(filepath.Join(t.TempDir(), "profiles.json")), []target.Target{adapter})
+	if err != nil {
+		t.Fatal(err)
+	}
+	createAndActivate(t, application)
+	refreshApplicationTargets(t, application)
+
+	snapshot := application.Snapshot()
+	if snapshot.Targets[0].PrimaryAction.Available || snapshot.Targets[0].PrimaryAction.DisabledReason != adapter.reason {
+		t.Fatalf("authority policy = %#v", snapshot.Targets[0].PrimaryAction)
+	}
+	result := application.Dispatch(app.Intent{Kind: app.EnableTarget, TargetID: adapter.ID()})
+	if result.Err == nil || !strings.Contains(result.Err.Error(), adapter.reason) || len(adapter.calls) != 0 {
+		t.Fatalf("blocked mutation result = %#v calls=%v", result, adapter.calls)
+	}
+}
+
 type targetWithID struct {
 	*fakeTarget
 	id string