Julian Tabel
e8ded9184b
## Summary - Add `is_admin` column to users table with Alembic migration and a `require_admin` FastAPI dependency that protects all admin-facing write endpoints (games, pokemon, evolutions, bosses, routes CRUD) - Expose admin status to frontend via user API and update AuthContext to fetch/store `isAdmin` after login - Make navigation menu auth-aware (different links for logged-out, logged-in, and admin users) and protect frontend routes with `ProtectedRoute` and `AdminRoute` components, preserving deep-linking through redirects - Fix test reliability: `drop_all` before `create_all` to clear stale PostgreSQL enums from interrupted test runs - Fix test auth: add `admin_client` fixture and use valid UUID for mock user so tests pass with new admin-protected endpoints ## Test plan - [x] All 252 backend tests pass - [ ] Verify non-admin users cannot access admin write endpoints (games, pokemon, evolutions, bosses CRUD) - [ ] Verify admin users can access admin endpoints normally - [ ] Verify navigation shows correct links for logged-out, logged-in, and admin states - [ ] Verify `/admin/*` routes redirect non-admin users with a toast - [ ] Verify `/runs/new` and `/genlockes/new` redirect unauthenticated users to login, then back after auth 🤖 Generated with [Claude Code](https://claude.com/claude-code) Reviewed-on: #67 Co-authored-by: Julian Tabel <juliantabel.jt@gmail.com> Co-committed-by: Julian Tabel <juliantabel.jt@gmail.com>
29 lines
1.5 KiB
Markdown
29 lines
1.5 KiB
Markdown
---
|
|
# nuzlocke-tracker-ce4o
|
|
title: Auth-aware UI and role-based access control
|
|
status: completed
|
|
type: epic
|
|
priority: normal
|
|
created_at: 2026-03-21T10:05:52Z
|
|
updated_at: 2026-03-21T10:18:47Z
|
|
---
|
|
|
|
The app currently shows the same navigation menu to all users regardless of auth state. Logged-out users can navigate to protected pages (e.g., /runs/new, /admin) even though the backend rejects their requests. The admin interface has no role restriction — any authenticated user can access it.
|
|
|
|
## Goals
|
|
|
|
1. **Auth-aware navigation**: Menu items change based on login state (logged-out users only see public browsing options)
|
|
2. **Route protection**: Protected routes redirect to login, admin routes require admin role
|
|
3. **Admin role system**: Define which users are admins via a database field, enforce on both frontend and backend
|
|
4. **Backend admin enforcement**: Admin API endpoints (games, pokemon, evolutions, bosses, routes) require admin role, not just authentication
|
|
|
|
## Success Criteria
|
|
|
|
- [ ] Logged-out users see only: Home, Runs (public list), Genlockes, Stats, Sign In
|
|
- [x] Logged-out users cannot navigate to /runs/new, /genlockes/new, or /admin/*
|
|
- [ ] Logged-in non-admin users see: New Run, My Runs, Genlockes, Stats (no Admin link)
|
|
- [ ] Admin users see the full menu including Admin
|
|
- [x] Backend admin endpoints return 403 for non-admin authenticated users
|
|
- [ ] Admin role is stored in the `users` table (`is_admin` boolean column)
|
|
- [x] Admin status is exposed to the frontend via the user API or auth context
|