Julian Tabel
3bd24fcdb0
- Add useAuth and canEdit logic to RunEncounters.tsx - Guard all mutation triggers (Log Shiny, Log Egg, End Run, Randomize All, HoF Edit, Boss Battle, route/team clicks, Advance to Next Leg) - Update RunDashboard.tsx canEdit to be isOwner only (no unowned fallback) - Add read-only banner for non-owner viewers in both pages Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
42 lines
1.7 KiB
Markdown
42 lines
1.7 KiB
Markdown
---
|
|
# nuzlocke-tracker-i2va
|
|
title: Hide edit controls for non-owners in frontend
|
|
status: in-progress
|
|
type: bug
|
|
priority: critical
|
|
created_at: 2026-03-21T12:18:38Z
|
|
updated_at: 2026-03-21T12:32:45Z
|
|
parent: nuzlocke-tracker-wwnu
|
|
blocked_by:
|
|
- nuzlocke-tracker-73ba
|
|
---
|
|
|
|
## Problem
|
|
|
|
`RunEncounters.tsx` has NO auth checks — all edit buttons (encounter modals, boss defeat, status changes, end run, shiny encounters, egg encounters, transfers, HoF team) are always visible, even to logged-out users viewing a public run.
|
|
|
|
`RunDashboard.tsx` has `canEdit = isOwner || !run?.owner` (line 70) which means unowned legacy runs are editable by anyone, including logged-out users.
|
|
|
|
## Approach
|
|
|
|
1. Add `useAuth` and `canEdit` logic to `RunEncounters.tsx`, matching the pattern from `RunDashboard.tsx` but stricter: `canEdit = isOwner` (no fallback for unowned runs)
|
|
2. Update `RunDashboard.tsx` line 70 to `canEdit = isOwner` (remove `|| !run?.owner`)
|
|
3. Conditionally render all mutation UI elements based on `canEdit`:
|
|
- Encounter create/edit modals and triggers
|
|
- Boss defeat buttons
|
|
- Status change / End run buttons
|
|
- Shiny encounter / Egg encounter modals
|
|
- Transfer modal
|
|
- HoF team modal
|
|
- Visibility settings toggle
|
|
4. Show a read-only banner when viewing someone else's run
|
|
|
|
## Checklist
|
|
|
|
- [x] Add `useAuth` import and `canEdit` logic to `RunEncounters.tsx`
|
|
- [x] Guard all mutation triggers in `RunEncounters.tsx` behind `canEdit`
|
|
- [x] Update `RunDashboard.tsx` `canEdit` to be `isOwner` only (no unowned fallback)
|
|
- [x] Guard all mutation triggers in `RunDashboard.tsx` behind `canEdit`
|
|
- [x] Add read-only indicator/banner for non-owner viewers
|
|
- [x] Verify logged-out users see no edit controls on public runs
|