arnaudne/Epicure
1
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

feat: moderator-scoped admin access + fix push notifications not displaying (v0.66.0)

Browse Source 
Moderator role existed in the schema and was already respected by
comment deletion, but every admin page/route treated moderator
identically to a regular user (403/redirect). Wires it up narrowly:
admin/layout.tsx now lets admin+moderator through and filters the
nav by role, while every admin-only page (users, tiers, settings,
webhooks, insights, etc.) explicitly redirects moderators away via a
new requireFullAdminPage() helper -- the nav filter is UX, this is
the actual gate. Moderators land on Reports and Recipes: reports
GET/PATCH now accept requireAdmin({allowModerator: true}), and a new
PATCH /api/v1/admin/recipes/[id] lets admin+moderator unpublish a
public recipe (flip to private) as a takedown action, audit-logged.

Also found and fixed a real bug while auditing the PWA push pipeline
for a "push click-through" gap: public/sw.js had no `push` event
listener at all, so incoming push messages never displayed anything
-- push was silently non-functional end-to-end despite the
subscribe/send plumbing all working. Added the push listener
(showNotification) and a notificationclick listener that focuses an
existing tab or opens one at the payload's url.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Arnaud
2026-07-21 23:31:47 +02:00
parent e3f2cf6834
commit 4c3880e07f
28 changed files with 231 additions and 39 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/web/app/admin/layout.tsx
+24 -24
View File
@@ -1,34 +1,34 @@
import { redirect } from "next/navigation";
import { headers } from "next/headers";
import { auth } from "@/lib/auth/server";
import { db, users, eq } from "@epicure/db";
import Link from "next/link";
import { Shield, Users, BookOpen, Settings, BarChart3, ClipboardList, HardDrive, Bot, ArrowLeft, Gauge, Mail, Flag, History, LifeBuoy, TrendingUp, Webhook } from "lucide-react";
import { cn } from "@/lib/utils";
import { getStaffRole } from "@/lib/require-admin-page";
import { redirect } from "next/navigation";
// adminOnly items are hidden from moderators (and, redundantly but safely,
// each of those pages also redirects moderators away server-side via
// requireFullAdminPage — the nav filter here is UX, not the real gate).
const adminNav = [
{ href: "/admin", label: "Overview", icon: BarChart3 },
{ href: "/admin/insights", label: "Insights", icon: TrendingUp },
{ href: "/admin/users", label: "Users", icon: Users },
{ href: "/admin/invites", label: "Invites", icon: Mail },
{ href: "/admin/recipes", label: "Recipes", icon: BookOpen },
{ href: "/admin/reports", label: "Reports", icon: Flag },
{ href: "/admin/support", label: "Support", icon: LifeBuoy },
{ href: "/admin/tiers", label: "Tier Limits", icon: Gauge },
{ href: "/admin/webhooks", label: "Webhooks", icon: Webhook },
{ href: "/admin/audit-logs", label: "Audit Logs", icon: ClipboardList },
{ href: "/admin/storage", label: "Storage", icon: HardDrive },
{ href: "/admin/ai-config", label: "AI Config", icon: Bot },
{ href: "/admin/settings", label: "Settings", icon: Settings },
{ href: "/admin/changelog", label: "Changelog", icon: History },
{ href: "/admin", label: "Overview", icon: BarChart3, adminOnly: true },
{ href: "/admin/insights", label: "Insights", icon: TrendingUp, adminOnly: true },
{ href: "/admin/users", label: "Users", icon: Users, adminOnly: true },
{ href: "/admin/invites", label: "Invites", icon: Mail, adminOnly: true },
{ href: "/admin/recipes", label: "Recipes", icon: BookOpen, adminOnly: false },
{ href: "/admin/reports", label: "Reports", icon: Flag, adminOnly: false },
{ href: "/admin/support", label: "Support", icon: LifeBuoy, adminOnly: true },
{ href: "/admin/tiers", label: "Tier Limits", icon: Gauge, adminOnly: true },
{ href: "/admin/webhooks", label: "Webhooks", icon: Webhook, adminOnly: true },
{ href: "/admin/audit-logs", label: "Audit Logs", icon: ClipboardList, adminOnly: true },
{ href: "/admin/storage", label: "Storage", icon: HardDrive, adminOnly: true },
{ href: "/admin/ai-config", label: "AI Config", icon: Bot, adminOnly: true },
{ href: "/admin/settings", label: "Settings", icon: Settings, adminOnly: true },
{ href: "/admin/changelog", label: "Changelog", icon: History, adminOnly: true },
];
export default async function AdminLayout({ children }: { children: React.ReactNode }) {
const session = await auth.api.getSession({ headers: await headers() });
if (!session) redirect("/login");
const role = await getStaffRole();
if (!role) redirect("/recipes");
const [dbUser] = await db.select({ role: users.role }).from(users).where(eq(users.id, session.user.id));
if (dbUser?.role !== "admin") redirect("/recipes");
const visibleNav = role === "admin" ? adminNav : adminNav.filter((item) => !item.adminOnly);
return (
<div className="flex flex-col md:flex-row min-h-screen">
@@ -36,7 +36,7 @@ export default async function AdminLayout({ children }: { children: React.ReactN
<div className="flex items-center justify-between gap-2 p-4 border-b font-semibold">
<span className="flex items-center gap-2">
<Shield className="h-4 w-4 text-destructive" />
Admin
{role === "admin" ? "Admin" : "Moderator"}
</span>
<Link
href="/recipes"
@@ -47,7 +47,7 @@ export default async function AdminLayout({ children }: { children: React.ReactN
</Link>
</div>
<nav className="flex overflow-x-auto gap-1 p-2 md:flex-col md:overflow-visible md:flex-1 [scrollbar-width:none] [&::-webkit-scrollbar]:hidden">
{adminNav.map(({ href, label, icon: Icon }) => (
{visibleNav.map(({ href, label, icon: Icon }) => (
<Link
key={href}
href={href}