Repository navigation
Access: admins switch between every screen; role re-read from the DB each request - #137
Merged
Merged
Conversation
dominickdupuy
requested review from
colerottenberg,
jrile018,
patrickbott,
raohemdutt and
ry2009
as code owners
October 14, 2026 23:30
… every request An admin (role exec_board) switches between the member, QT and investor screens and is the only one who sees and uses the admin tab and routes. The role is no longer taken from the JWT claim: access.current_role reads auth.users on every request, like the screens, so a promotion or a demotion takes effect on the next request rather than when the 12-hour token expires, and a token whose user was deleted keeps no role and no screen.
dominickdupuy
force-pushed
the
qt/admin-screens
branch
from
October 14, 2026 23:30
1a66e15 to
067dbf6
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Dom (2026-10-14): admins can switch between member, QT and investor; only admins see the admin tab; make it secure.
Policy
exec_board, legacyadmin) holds every screen, server side (GetUserScreens), so the switcher shows Member / Investor / QT / Admin. Non-admins keep exactly their granted screens; the Admin tab and every/api/admin/*route stay admin-only.Security fixes
access.current_role()readsauth.users.roleon every request (cached per request) and is used byadmin_only,/api/me/screens,current_user()and screen resolution. The JWT role claim is no longer used for access.UI: the Admin page marks admin users ("sees every screen and the Admin tab, whatever is ticked here").
Tests: backend 374 (new: admin holds every screen, demotion/promotion take effect on the next request, deleted user keeps no access);
role_foragainst real Postgres; vitest 153.Known, not in this PR: logout does not revoke a stolen token (no blocklist; screens and admin are now re-checked per request, which limits it to the user's current rights).