From 3ec6c0a7f85074b591a202767b3c1a682c95ed53 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sascha=20I=C3=9Fbr=C3=BCcker?=
 <sascha.issbruecker@googlemail.com>
Date: Tue, 26 Aug 2025 19:06:04 +0200
Subject: [PATCH] Hide tag menu for unauthenticated users (#1176)

---
 .../templates/bookmarks/tag_section.html      | 34 ++++++++++---------
 bookmarks/tests/test_bookmark_shared_view.py  | 18 ++++++++++
 2 files changed, 36 insertions(+), 16 deletions(-)

diff --git a/bookmarks/templates/bookmarks/tag_section.html b/bookmarks/templates/bookmarks/tag_section.html
index b22c66e..4e57717 100644
--- a/bookmarks/templates/bookmarks/tag_section.html
+++ b/bookmarks/templates/bookmarks/tag_section.html
@@ -1,22 +1,24 @@
 <section aria-labelledby="tags-heading">
   <div class="section-header no-wrap">
     <h2 id="tags-heading">Tags</h2>
-    <div ld-dropdown class="dropdown dropdown-right ml-auto">
-      <button class="btn btn-noborder dropdown-toggle" aria-label="Tabs menu">
-        <svg xmlns="http://www.w3.org/2000/svg" width="20" height="20" viewBox="0 0 24 24" fill="none"
-             stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
-          <path stroke="none" d="M0 0h24v24H0z" fill="none"/>
-          <path d="M4 6l16 0"/>
-          <path d="M4 12l16 0"/>
-          <path d="M4 18l16 0"/>
-        </svg>
-      </button>
-      <ul class="menu" role="list" tabindex="-1">
-        <li class="menu-item">
-          <a href="{% url 'linkding:tags.index' %}" class="menu-link">Manage tags</a>
-        </li>
-      </ul>
-    </div>
+    {% if user.is_authenticated %}
+      <div ld-dropdown class="dropdown dropdown-right ml-auto">
+        <button class="btn btn-noborder dropdown-toggle" aria-label="Tags menu">
+          <svg xmlns="http://www.w3.org/2000/svg" width="20" height="20" viewBox="0 0 24 24" fill="none"
+               stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+            <path stroke="none" d="M0 0h24v24H0z" fill="none"/>
+            <path d="M4 6l16 0"/>
+            <path d="M4 12l16 0"/>
+            <path d="M4 18l16 0"/>
+          </svg>
+        </button>
+        <ul class="menu" role="list" tabindex="-1">
+          <li class="menu-item">
+            <a href="{% url 'linkding:tags.index' %}" class="menu-link">Manage tags</a>
+          </li>
+        </ul>
+      </div>
+    {% endif %}
   </div>
   <div id="tag-cloud-container">
     {% include 'bookmarks/tag_cloud.html' %}
diff --git a/bookmarks/tests/test_bookmark_shared_view.py b/bookmarks/tests/test_bookmark_shared_view.py
index f512ccd..c0a25bb 100644
--- a/bookmarks/tests/test_bookmark_shared_view.py
+++ b/bookmarks/tests/test_bookmark_shared_view.py
@@ -660,3 +660,21 @@ class BookmarkSharedViewTestCase(
         feed = soup.select_one('head link[type="application/rss+xml"]')
         self.assertIsNotNone(feed)
         self.assertEqual(feed.attrs["href"], reverse("linkding:feeds.public_shared"))
+
+    def test_tag_menu_visible_for_authenticated_user(self):
+        self.authenticate()
+
+        response = self.client.get(reverse("linkding:bookmarks.shared"))
+        html = response.content.decode()
+
+        soup = self.make_soup(html)
+        tag_menu = soup.find(attrs={"aria-label": "Tags menu"})
+        self.assertIsNotNone(tag_menu)
+
+    def test_tag_menu_not_visible_for_unauthenticated_user(self):
+        response = self.client.get(reverse("linkding:bookmarks.shared"))
+        html = response.content.decode()
+
+        soup = self.make_soup(html)
+        tag_menu = soup.find(attrs={"aria-label": "Tags menu"})
+        self.assertIsNone(tag_menu)