Skip to content

Restrict admin-only controls in Settings based on member role #292

Description

@Lakes41

Difficulty: Intermediate
Type: security

Background
The dashboard has "admin controls" per its description, and the Settings page (/settings) likely exposes guild/app-level configuration that shouldn't be editable by every member role.

Problem
There is no visible role-gating on Settings controls, so any authenticated (or even unauthenticated, given the app currently runs on mock data with no auth) user can view/change admin-only options.

Expected outcome
Settings controls are conditionally rendered/disabled based on the current mock user's role (e.g., owner/admin vs. member), with a clear "insufficient permissions" state for non-admins.

Suggested implementation

  • Add a role field to the mock current-user data if not already present.
  • Create a useCurrentUserRole hook (or context) that the Settings page and other admin-only UI can consume.
  • Wrap admin-only sections in a permission-gated component that hides or disables controls and shows an explanatory message.
  • Document the intended role model in docs/ or a new PERMISSIONS.md.

Acceptance criteria

  • Non-admin mock users cannot see/edit admin-only settings
  • Admin mock users retain full access
  • Permission logic is centralized (not duplicated per-component)
  • Behavior is documented for future real-auth integration

Likely affected files/directories

  • apps/dashboard/app/settings/
  • apps/dashboard/lib/mock-data.ts
  • apps/dashboard/hooks/ or apps/dashboard/lib/permissions.ts (new)

Metadata

Metadata

Labels

GrantFox OSSGrantFox Open Source Sponsorship program tagMaybe RewardedIssue may qualify for a reward upon successful completion per campaign rulesOfficial Campaign | FWC26Official FWC26 campaign issue — eligible for campaign scoring and rewardsintermediateIntermediate difficulty tasks requiring solid experience and some contextsecuritySecurity-related fix, hardening, audit, or vulnerability remediation

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions