Difficulty: Intermediate
Type: security
Background
The dashboard has "admin controls" per its description, and the Settings page (/settings) likely exposes guild/app-level configuration that shouldn't be editable by every member role.
Problem
There is no visible role-gating on Settings controls, so any authenticated (or even unauthenticated, given the app currently runs on mock data with no auth) user can view/change admin-only options.
Expected outcome
Settings controls are conditionally rendered/disabled based on the current mock user's role (e.g., owner/admin vs. member), with a clear "insufficient permissions" state for non-admins.
Suggested implementation
- Add a
role field to the mock current-user data if not already present.
- Create a
useCurrentUserRole hook (or context) that the Settings page and other admin-only UI can consume.
- Wrap admin-only sections in a permission-gated component that hides or disables controls and shows an explanatory message.
- Document the intended role model in
docs/ or a new PERMISSIONS.md.
Acceptance criteria
Likely affected files/directories
apps/dashboard/app/settings/
apps/dashboard/lib/mock-data.ts
apps/dashboard/hooks/ or apps/dashboard/lib/permissions.ts (new)
Difficulty: Intermediate
Type: security
Background
The dashboard has "admin controls" per its description, and the Settings page (
/settings) likely exposes guild/app-level configuration that shouldn't be editable by every member role.Problem
There is no visible role-gating on Settings controls, so any authenticated (or even unauthenticated, given the app currently runs on mock data with no auth) user can view/change admin-only options.
Expected outcome
Settings controls are conditionally rendered/disabled based on the current mock user's role (e.g., owner/admin vs. member), with a clear "insufficient permissions" state for non-admins.
Suggested implementation
rolefield to the mock current-user data if not already present.useCurrentUserRolehook (or context) that the Settings page and other admin-only UI can consume.docs/or a newPERMISSIONS.md.Acceptance criteria
Likely affected files/directories
apps/dashboard/app/settings/apps/dashboard/lib/mock-data.tsapps/dashboard/hooks/orapps/dashboard/lib/permissions.ts(new)