mptyl/ThothII
1
0
Fork 0
Code Issues 25 Pull Requests Actions Packages Projects Releases 1 Wiki Activity

fix(frontend): restrict management controls to admins

Browse Source
This commit is contained in:
Codex
2026-08-26 20:40:15 +02:00
parent 9189450fa9
commit 705af3aeb2
2 changed files with 31 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
frontend/src/shell/AppShell.database-management.test.tsx
+8 -6
View File
@@ -22,9 +22,9 @@ beforeEach(() => {
setAuthState({
issuer: "test",
subject: "test",
roles: ["user"],
permissions: ["session.use", "workspace.manage"],
isAdmin: false,
roles: ["admin"],
permissions: ["session.use", "workspace.manage", "workspace.secrets.manage", "pi.manage"],
isAdmin: true,
csrfToken: null,
session: null,
});
@@ -37,7 +37,7 @@ beforeEach(() => {
issuer: "test",
subject: "test",
displayName: "Test",
isAdmin: false,
isAdmin: true,
})),
http.get("/api/sessions", () => HttpResponse.json([])),
http.get("/api/settings", () => HttpResponse.json({
@@ -122,7 +122,7 @@ test("keeps a live core session connected and returns when that session is opene
expect(FakeEventSource.instances).toHaveLength(1);
});
test("shows database management entry to authenticated users without workspace management permission", () => {
test("hides all management entries from non-admin users", () => {
clearAuthState();
setAuthState({
issuer: "test",
@@ -136,5 +136,7 @@ test("shows database management entry to authenticated users without workspace m
renderShell();
expect(screen.getByRole("button", { name: "Database management" })).toBeInTheDocument();
expect(screen.queryByRole("button", { name: "Workspace management" })).not.toBeInTheDocument();
expect(screen.queryByRole("button", { name: "Database management" })).not.toBeInTheDocument();
expect(screen.queryByRole("button", { name: "Pi management" })).not.toBeInTheDocument();
});
frontend/src/shell/AppShell.tsx
+23 -18
View File
@@ -105,6 +105,7 @@ export function AppShell({ canLogout }: AppShellProps) {
const canManageWorkspace = permissions.includes("workspace.manage");
const canManageWorkspaceSecrets = permissions.includes("workspace.secrets.manage");
const canManagePi = permissions.includes("pi.manage");
const isAdmin = authenticatedUser?.isAdmin === true;
const authGeneration = useAuthGeneration();
const { data: sessions = [] } = useQuery<SessionSummary[]>({
queryKey: ["sessions", sessionScope],
@@ -737,24 +738,28 @@ export function AppShell({ canLogout }: AppShellProps) {
>
New session
</Button>
<Button
variant="outline"
size="sm"
className="w-full"
onClick={() => setWorkspaceManagerOpen(true)}
>
Workspace management
</Button>
<Button
variant="outline"
size="sm"
className="w-full"
aria-current={activeSurface === "database-management" ? "page" : undefined}
onClick={() => setActiveSurface("database-management")}
>
Database management
</Button>
{canManagePi && (
{isAdmin && (
<>
<Button
variant="outline"
size="sm"
className="w-full"
onClick={() => setWorkspaceManagerOpen(true)}
>
Workspace management
</Button>
<Button
variant="outline"
size="sm"
className="w-full"
aria-current={activeSurface === "database-management" ? "page" : undefined}
onClick={() => setActiveSurface("database-management")}
>
Database management
</Button>
</>
)}
{isAdmin && canManagePi && (
<Button
variant="outline"
size="sm"