fix(sharing): address code review: fix default role, auto-share logic, aria labels

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
Agent-Logs-Url: https://github.com/christianlouis/DocuElevate/sessions/8091889d-4810-4794-b9d3-6b8f7f5257c4

app/api/comments.py

@@ -264,8 +264,9 @@ def create_comment(
 
             if _settings.multi_user_enabled:
                 for mentioned_user in mentions:
-                    # Skip the commenter themselves and the file owner
-                    if mentioned_user in (owner_id, file_record.owner_id):
+                    # Skip the file owner (already has full access) and the commenter
+                    # themselves (they already have access to be posting a comment).
+                    if mentioned_user in {file_record.owner_id, owner_id}:
                         continue
                     existing_share = (
                         db.query(FileShare)

app/views/files.py

@@ -503,7 +503,11 @@ def file_annotations_page(request: Request, file_id: int, db: Session = Depends(
         current_owner_id = get_current_owner_id(request)
         user_session = request.session.get("user")
         is_admin = isinstance(user_session, dict) and bool(user_session.get("is_admin"))
-        current_user_role = "owner" if is_admin else (get_file_role(file_record, current_owner_id, db) or "viewer")
+        if is_admin:
+            current_user_role: str | None = "owner"
+        else:
+            current_user_role = get_file_role(file_record, current_owner_id, db)
+            # None means no access — the template will not show owner-only UI
 
         return templates.TemplateResponse(
             "file_annotations.html",