Node page shows admin-only buttons to non-admins (Restart OP25, override Ack/Force Revert): dead CTAs #222

New Issue

2026-10-04T20:08:46-04:00

logan commented

2026-10-04 20:08:46 -04:00

Found while building the #213 item 3 picker (PR #220). Searched open and closed issues for a duplicate and found none.

drb-frontend/app/nodes/[id]/page.tsx renders these controls to every signed-in user, but the routes behind them are admin-only, so an org owner, operator or member who clicks one gets a raw error:

Restart OP25 → POST /nodes/{id}/command → require_service_key_or_admin.
Ack (Reset 24h Timer) → POST /nodes/{id}/override/ack → require_service_key_or_admin.
Force Revert Config → POST /nodes/{id}/override/reset → require_service_key_or_admin.
Possibly also Configure / Reassign System (POST /nodes/{id}/config/{system_id}): check its auth.

Fix: either gate them on isAdmin in the UI, or widen the routes to the node's org owner or owning operator, using the same rule PR #220 uses for Discord streams (routers/discord_web.py::_node_for_caller). Which one is a product call: should org owners be able to restart their own node's decoder?

PR #220 already moved the Discord Join/Leave buttons off /command. They had the same problem.

Found while building the #213 item 3 picker (PR #220). Searched open and closed issues for a duplicate and found none. `drb-frontend/app/nodes/[id]/page.tsx` renders these controls to every signed-in user, but the routes behind them are admin-only, so an org owner, operator or member who clicks one gets a raw error: - **Restart OP25** → `POST /nodes/{id}/command` → `require_service_key_or_admin`. - **Ack (Reset 24h Timer)** → `POST /nodes/{id}/override/ack` → `require_service_key_or_admin`. - **Force Revert Config** → `POST /nodes/{id}/override/reset` → `require_service_key_or_admin`. - Possibly also **Configure / Reassign System** (`POST /nodes/{id}/config/{system_id}`): check its auth. Fix: either gate them on `isAdmin` in the UI, or widen the routes to the node's org owner or owning operator, using the same rule PR #220 uses for Discord streams (`routers/discord_web.py::_node_for_caller`). Which one is a product call: should org owners be able to restart their own node's decoder? PR #220 already moved the Discord Join/Leave buttons off `/command`. They had the same problem.

logan added the area/auth area/frontend

labels 2026-10-05 02:05:05 -04:00

logan referenced this issue

2026-10-25 21:31:55 -04:00

Systems page offers create/edit/delete and AI panels to operators; every backend route is admin-only, and Delete fails silently #283

logan commented

2026-10-25 21:32:21 -04:00

UX pass 2026-10-25: confirmed the open question. Configure/Reassign System (app/nodes/[id]/page.tsx, NodeConfigModal) is shown to everyone and POST /nodes/{id}/config/{system_id} is require_service_key_or_admin (nodes.py:250-256). Same for the 'Needs Configuration' cards on /nodes, which operators can reach (nodes/page.tsx:20) -- so the first-run setup action 403s for operators and owners. Also PATCH /nodes/{id} (SdrSettings is already canEdit-gated, fine). Fix scope should include Configure/Reassign. Related new issue: #283 (systems page).

logan referenced this issue from a commit

2026-10-25 22:17:24 -04:00

fix(frontend): hide admin-only node and system controls from non-admins (#222, #283)

logan referenced a pull request that will close this issue

2026-10-25 22:17:24 -04:00

Frontend: hide admin-only node/system controls from non-admins (#222, #283) + popup contrast #291

logan closed this issue

2026-10-25 22:17:26 -04:00

logan referenced this issue from a commit

2026-10-25 22:17:27 -04:00

Merge pull request 'Frontend: hide admin-only node/system controls from non-admins (#222, #283) + popup contrast' (#291) from fix/222-283-admin-gating into main

Sign in to join this conversation.