diff --git a/app/controllers/users_controller.rb b/app/controllers/users_controller.rb
index 51025dd1..9affdf4c 100644
--- a/app/controllers/users_controller.rb
+++ b/app/controllers/users_controller.rb
@@ -54,7 +54,8 @@ class UsersController < ApplicationController
def update
return redirect_to settings_users_path, notice: I18n.t('unable_to_update_user') if Docuseal.demo?
- attrs = user_params.compact_blank.merge(user_params.slice(:archived_at))
+ attrs = user_params.compact_blank
+ attrs = attrs.merge(user_params.slice(:archived_at)) if current_ability.can?(:create, @user)
if params.dig(:user, :account_id).present?
account = Account.accessible_by(current_ability).find(params.dig(:user, :account_id))
diff --git a/app/views/users/index.html.erb b/app/views/users/index.html.erb
index e49a8563..33e7eb2c 100644
--- a/app/views/users/index.html.erb
+++ b/app/views/users/index.html.erb
@@ -12,15 +12,24 @@
<% end %>
- <% if params[:status].blank? && can?(:create, User.new(account: current_account)) %>
- <%= render 'users/extra_buttons' %>
- <% if content_for(:add_user_button) %>
- <%= content_for(:add_user_button) %>
- <% else %>
- <%= link_to new_user_path, class: 'btn btn-primary btn-md gap-2 w-full md:w-fit', data: { turbo_frame: 'modal' } do %>
- <%= svg_icon('plus', class: 'w-6 h-6') %>
-
<%= t('new_user') %>
+ <% if params[:status].blank? %>
+ <% if can?(:create, User.new(account: current_account)) %>
+ <%= render 'users/extra_buttons' %>
+ <% if content_for(:add_user_button) %>
+ <%= content_for(:add_user_button) %>
+ <% else %>
+ <%= link_to new_user_path, class: 'btn btn-primary btn-md gap-2 w-full md:w-fit', data: { turbo_frame: 'modal' } do %>
+ <%= svg_icon('plus', class: 'w-6 h-6') %>
+
<%= t('new_user') %>
+ <% end %>
<% end %>
+ <% else %>
+
+ <%= link_to '#', class: 'btn btn-primary btn-md gap-2 w-full md:w-fit btn-disabled', data: { turbo_frame: 'modal' } do %>
+ <%= svg_icon('plus', class: 'w-6 h-6') %>
+ <%= t('new_user') %>
+ <% end %>
+
<% end %>
<% end %>
@@ -79,7 +88,7 @@
<%= t('remove') %>
<% end %>
<% end %>
- <% if params[:status] == 'archived' && can?(:manage, user) && user != current_user && user.archived_at? %>
+ <% if params[:status] == 'archived' && can?(:create, user) && user != current_user && user.archived_at? %>
<%= button_to user_path(user), method: :put, params: { user: { archived_at: nil } }, class: 'btn btn-outline btn-xs', title: t('unarchive'), data: { turbo_confirm: t('are_you_sure_') } do %>
<%= t('unarchive') %>
<% end %>