Systems page offers create/edit/delete and AI panels to operators; every backend route is admin-only, and Delete fails silently #283

New Issue

2026-10-25T21:31:55-04:00

logan commented

2026-10-25 21:31:55 -04:00

Found in a UX pass 2026-10-25. Searched open+closed: no duplicate (#222 covers /nodes/[id] buttons only).

/systems is reachable by operators (app/systems/page.tsx:1914-1930, isAdmin || isOperator) and linked from the Network hub, but every write and most panels behind it are require_admin_token (drb-c2-core/app/routers/systems.py:69,83,114,124,161,190,210,260,286,296).

What an operator sees:

+ New System, Edit, Duplicate, Save -> raw 403 in the form.
Delete: handleDelete (page.tsx:1931-1934) has no try/catch, so the confirm dialog passes and nothing happens, no message. An admin deleting an in-use system gets the same silence on any server error.
AiFlags / AreaContext / TalkgroupPending panels mount for everyone; area-context GET and talkgroup-pending are admin-only, so they error or sit empty.

Fix: gate write controls and admin-only panels on isAdmin (as PreferredTokenPanel already is at page.tsx:2031), or widen the routes to operators; add try/catch + visible error to delete.

Found in a UX pass 2026-10-25. Searched open+closed: no duplicate (#222 covers /nodes/[id] buttons only). `/systems` is reachable by operators (`app/systems/page.tsx:1914-1930`, `isAdmin || isOperator`) and linked from the Network hub, but every write and most panels behind it are `require_admin_token` (`drb-c2-core/app/routers/systems.py:69,83,114,124,161,190,210,260,286,296`). What an operator sees: - `+ New System`, Edit, Duplicate, Save -> raw 403 in the form. - **Delete**: `handleDelete` (`page.tsx:1931-1934`) has no try/catch, so the confirm dialog passes and nothing happens, no message. An admin deleting an in-use system gets the same silence on any server error. - AiFlags / AreaContext / TalkgroupPending panels mount for everyone; area-context GET and talkgroup-pending are admin-only, so they error or sit empty. Fix: gate write controls and admin-only panels on `isAdmin` (as `PreferredTokenPanel` already is at `page.tsx:2031`), or widen the routes to operators; add try/catch + visible error to delete.

logan added the

labels 2026-10-25 21:31:55 -04:00

logan referenced this issue

2026-10-25 21:32:21 -04:00

Node page shows admin-only buttons to non-admins (Restart OP25, override Ack/Force Revert): dead CTAs #222

logan referenced this issue from a commit

2026-10-25 22:17:24 -04:00