{% set su = user.is_superuser if user else False %}
{% set p = user.permissions if user else [] %}
{% set can_admin = su or "users:read" in p or "roles:read" in p or "audit_log:read" in p %}
{% set can_connections = su or "clamp_connections:read" in p or "iso_threads:read" in p or "static_connections:read" in p or "unc_threads:read" in p %}
{% set can_labels = su or "attachment_point_names:read" in p or "manufacturers:read" in p or "part_colours:read" in p or "part_types:read" in p or "scope_models:read" in p or "sub_part_types:read" in p %}
{% set can_database = su or "imported_parts:read" in p or "augmented_parts:read" in p or "attachment_points:read" in p %}
{% set can_parts = can_connections or can_labels or can_database %}
{# /scopes is public, so anonymous visitors see the link too; logged-in users still need the read perms. #}
{% set can_scopes = (not user) or su or ("augmented_parts:read" in p and "fits:read" in p) %}
{# ── SVG icon sprite ───────────────────────────────────────────────────────── #}
{# ── Nav macro for DRY icon use ────────────────────────────────────────────── #}
{% macro icon(id) %}{% endmacro %}