Julian Tabel
e8ded9184b
## Summary - Add `is_admin` column to users table with Alembic migration and a `require_admin` FastAPI dependency that protects all admin-facing write endpoints (games, pokemon, evolutions, bosses, routes CRUD) - Expose admin status to frontend via user API and update AuthContext to fetch/store `isAdmin` after login - Make navigation menu auth-aware (different links for logged-out, logged-in, and admin users) and protect frontend routes with `ProtectedRoute` and `AdminRoute` components, preserving deep-linking through redirects - Fix test reliability: `drop_all` before `create_all` to clear stale PostgreSQL enums from interrupted test runs - Fix test auth: add `admin_client` fixture and use valid UUID for mock user so tests pass with new admin-protected endpoints ## Test plan - [x] All 252 backend tests pass - [ ] Verify non-admin users cannot access admin write endpoints (games, pokemon, evolutions, bosses CRUD) - [ ] Verify admin users can access admin endpoints normally - [ ] Verify navigation shows correct links for logged-out, logged-in, and admin states - [ ] Verify `/admin/*` routes redirect non-admin users with a toast - [ ] Verify `/runs/new` and `/genlockes/new` redirect unauthenticated users to login, then back after auth 🤖 Generated with [Claude Code](https://claude.com/claude-code) Reviewed-on: #67 Co-authored-by: Julian Tabel <juliantabel.jt@gmail.com> Co-committed-by: Julian Tabel <juliantabel.jt@gmail.com>
39 lines
1.7 KiB
Markdown
39 lines
1.7 KiB
Markdown
---
|
|
# nuzlocke-tracker-2zwg
|
|
title: Protect frontend routes with ProtectedRoute and AdminRoute
|
|
status: completed
|
|
type: task
|
|
priority: normal
|
|
created_at: 2026-03-21T10:06:20Z
|
|
updated_at: 2026-03-21T10:19:41Z
|
|
parent: nuzlocke-tracker-ce4o
|
|
blocked_by:
|
|
- nuzlocke-tracker-5svj
|
|
---
|
|
|
|
Use the existing \`ProtectedRoute\` component (currently unused) and create an \`AdminRoute\` component to guard routes in \`App.tsx\`.
|
|
|
|
## Checklist
|
|
|
|
- [x] Wrap \`/runs/new\` and \`/genlockes/new\` with \`ProtectedRoute\` (requires login)
|
|
- [x] Create \`AdminRoute\` component that checks \`isAdmin\` from \`useAuth()\`, redirects to \`/\` with a toast/message if not admin
|
|
- [x] Wrap all \`/admin/*\` routes with \`AdminRoute\`
|
|
- [x] Ensure \`/runs\` and \`/runs/:runId\` remain accessible to everyone (public run viewing)
|
|
- [x] Verify deep-linking works (e.g., visiting \`/admin/games\` while logged out redirects to login, then back to \`/admin/games\` after auth)
|
|
|
|
## Files to change
|
|
|
|
- \`frontend/src/App.tsx\` — wrap routes
|
|
- \`frontend/src/components/ProtectedRoute.tsx\` — already exists, verify it works
|
|
- \`frontend/src/components/AdminRoute.tsx\` — new file
|
|
|
|
## Summary of Changes
|
|
|
|
Implemented frontend route protection:
|
|
|
|
- **ProtectedRoute**: Wraps `/runs/new` and `/genlockes/new` - redirects unauthenticated users to `/login` with return location preserved
|
|
- **AdminRoute**: New component that checks `isAdmin` from `useAuth()`, redirects non-admins to `/` with a toast notification
|
|
- **Admin routes**: Wrapped `AdminLayout` with `AdminRoute` to protect all `/admin/*` routes
|
|
- **Public routes**: `/runs` and `/runs/:runId` remain accessible to everyone
|
|
- **Deep-linking**: Location state preserved so users return to original route after login
|