Gate /admin to staff roles; role-aware login redirects for players #44

wtclaude · 2026-07-07T01:01:29Z

wtclaude commented

2026-07-07 01:01:29 +00:00

Follow-up hardening to the merged player-accounts work (#43). Introducing the player role turned "logged-in" into "logged-in but possibly untrusted", but the admin router only gated its content routes (dashboard, posts, wiki, uploads) by isLoggedIn — so a player session could reach editor-tier endpoints.

Changes

Backend: requireRole('admin','editor','moderator') at the /admin router base. Players now get 403 on all /admin/* and use the /player group instead. Editors/moderators unaffected.
Client: RequireAuth redirects a signed-in player to /account (mirrors RequirePlayer).
Both login pages redirect by role after auth (player → /account, staff → /admin) so you land in the right shell whichever door you used. Login pages stay separate by design.

Verification

Live: player token 403 on /admin/dashboard + /admin/users, 200 on /player/account.
Browser click-through: a signed-in player at /admin and at /admin/login both land on /account.
134 server tests green; client builds.

🤖 Generated with Claude Code

https://claude.ai/code/session_019rao86n5cXpwAyjdBFEshV

Follow-up hardening to the merged player-accounts work (#43). Introducing the `player` role turned "logged-in" into "logged-in but possibly untrusted", but the admin router only gated its content routes (dashboard, posts, wiki, uploads) by `isLoggedIn` — so a player session could reach editor-tier endpoints. ## Changes - **Backend:** `requireRole('admin','editor','moderator')` at the `/admin` router base. Players now get **403** on all `/admin/*` and use the `/player` group instead. Editors/moderators unaffected. - **Client:** `RequireAuth` redirects a signed-in player to `/account` (mirrors `RequirePlayer`). - **Both login pages** redirect by role after auth (player → `/account`, staff → `/admin`) so you land in the right shell whichever door you used. Login pages stay separate by design. ## Verification - Live: player token **403** on `/admin/dashboard` + `/admin/users`, **200** on `/player/account`. - Browser click-through: a signed-in player at `/admin` and at `/admin/login` both land on `/account`. - 134 server tests green; client builds. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_019rao86n5cXpwAyjdBFEshV

wtclaude added 1 commit 2026-07-07 01:01:32 +00:00

Gate /admin to staff roles; role-aware login redirects for players 82807d18d9

Introducing the 'player' role turned 'logged-in' into 'logged-in but possibly
untrusted', but the admin router only gated content routes (dashboard, posts,
wiki, uploads) by isLoggedIn — so a player session could reach editor-tier
endpoints. Fixes:
- Backend: requireRole('admin','editor','moderator') at the admin router base;
  players now 403 on all /admin/* and use /player instead.
- Client: RequireAuth redirects a signed-in player to /account (mirrors
  RequirePlayer).
- Both login pages redirect by role after auth (player -> /account, staff ->
  /admin) so you land in the right shell whichever door you used.

Verified live: player token 403s on /admin/dashboard + /admin/users, 200s on
/player/account; browser click-through confirms a player at /admin and at
/admin/login both land on /account. 134 server tests green; client builds.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019rao86n5cXpwAyjdBFEshV

whitlocktech approved these changes 2026-07-07 01:02:36 +00:00

whitlocktech added 1 commit 2026-07-07 01:02:45 +00:00

Merge branch 'main' into feature/player-accounts cda0c16149

whitlocktech merged commit 5da27879e5 into main

2026-07-07 01:02:54 +00:00

whitlocktech deleted branch feature/player-accounts

2026-07-07 01:02:55 +00:00

whitlocktech referenced this issue from a commit

2026-07-07 01:02:56 +00:00

Merge pull request 'Gate /admin to staff roles; role-aware login redirects for players' (#44) from feature/player-accounts into main

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: RunicGateway/website#44