2026-03-21 11:06:53 +01:00
|
|
|
---
|
|
|
|
|
# nuzlocke-tracker-h205
|
|
|
|
|
title: Auth-aware navigation menu
|
feat: auth-aware UI and role-based access control (#67)
## Summary
- Add `is_admin` column to users table with Alembic migration and a `require_admin` FastAPI dependency that protects all admin-facing write endpoints (games, pokemon, evolutions, bosses, routes CRUD)
- Expose admin status to frontend via user API and update AuthContext to fetch/store `isAdmin` after login
- Make navigation menu auth-aware (different links for logged-out, logged-in, and admin users) and protect frontend routes with `ProtectedRoute` and `AdminRoute` components, preserving deep-linking through redirects
- Fix test reliability: `drop_all` before `create_all` to clear stale PostgreSQL enums from interrupted test runs
- Fix test auth: add `admin_client` fixture and use valid UUID for mock user so tests pass with new admin-protected endpoints
## Test plan
- [x] All 252 backend tests pass
- [ ] Verify non-admin users cannot access admin write endpoints (games, pokemon, evolutions, bosses CRUD)
- [ ] Verify admin users can access admin endpoints normally
- [ ] Verify navigation shows correct links for logged-out, logged-in, and admin states
- [ ] Verify `/admin/*` routes redirect non-admin users with a toast
- [ ] Verify `/runs/new` and `/genlockes/new` redirect unauthenticated users to login, then back after auth
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Reviewed-on: https://gitea.nerdboden.de/pokemon/nuzlocke-tracker/pulls/67
Co-authored-by: Julian Tabel <juliantabel.jt@gmail.com>
Co-committed-by: Julian Tabel <juliantabel.jt@gmail.com>
2026-03-21 11:44:05 +01:00
|
|
|
status: completed
|
2026-03-21 11:06:53 +01:00
|
|
|
type: task
|
|
|
|
|
priority: normal
|
|
|
|
|
created_at: 2026-03-21T10:06:20Z
|
feat: auth-aware UI and role-based access control (#67)
## Summary
- Add `is_admin` column to users table with Alembic migration and a `require_admin` FastAPI dependency that protects all admin-facing write endpoints (games, pokemon, evolutions, bosses, routes CRUD)
- Expose admin status to frontend via user API and update AuthContext to fetch/store `isAdmin` after login
- Make navigation menu auth-aware (different links for logged-out, logged-in, and admin users) and protect frontend routes with `ProtectedRoute` and `AdminRoute` components, preserving deep-linking through redirects
- Fix test reliability: `drop_all` before `create_all` to clear stale PostgreSQL enums from interrupted test runs
- Fix test auth: add `admin_client` fixture and use valid UUID for mock user so tests pass with new admin-protected endpoints
## Test plan
- [x] All 252 backend tests pass
- [ ] Verify non-admin users cannot access admin write endpoints (games, pokemon, evolutions, bosses CRUD)
- [ ] Verify admin users can access admin endpoints normally
- [ ] Verify navigation shows correct links for logged-out, logged-in, and admin states
- [ ] Verify `/admin/*` routes redirect non-admin users with a toast
- [ ] Verify `/runs/new` and `/genlockes/new` redirect unauthenticated users to login, then back after auth
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Reviewed-on: https://gitea.nerdboden.de/pokemon/nuzlocke-tracker/pulls/67
Co-authored-by: Julian Tabel <juliantabel.jt@gmail.com>
Co-committed-by: Julian Tabel <juliantabel.jt@gmail.com>
2026-03-21 11:44:05 +01:00
|
|
|
updated_at: 2026-03-21T10:22:34Z
|
2026-03-21 11:06:53 +01:00
|
|
|
parent: nuzlocke-tracker-ce4o
|
|
|
|
|
blocked_by:
|
|
|
|
|
- nuzlocke-tracker-5svj
|
|
|
|
|
---
|
|
|
|
|
|
|
|
|
|
Update the Layout component to show different nav links based on auth state and admin role.
|
|
|
|
|
|
|
|
|
|
## Checklist
|
|
|
|
|
|
feat: auth-aware UI and role-based access control (#67)
## Summary
- Add `is_admin` column to users table with Alembic migration and a `require_admin` FastAPI dependency that protects all admin-facing write endpoints (games, pokemon, evolutions, bosses, routes CRUD)
- Expose admin status to frontend via user API and update AuthContext to fetch/store `isAdmin` after login
- Make navigation menu auth-aware (different links for logged-out, logged-in, and admin users) and protect frontend routes with `ProtectedRoute` and `AdminRoute` components, preserving deep-linking through redirects
- Fix test reliability: `drop_all` before `create_all` to clear stale PostgreSQL enums from interrupted test runs
- Fix test auth: add `admin_client` fixture and use valid UUID for mock user so tests pass with new admin-protected endpoints
## Test plan
- [x] All 252 backend tests pass
- [ ] Verify non-admin users cannot access admin write endpoints (games, pokemon, evolutions, bosses CRUD)
- [ ] Verify admin users can access admin endpoints normally
- [ ] Verify navigation shows correct links for logged-out, logged-in, and admin states
- [ ] Verify `/admin/*` routes redirect non-admin users with a toast
- [ ] Verify `/runs/new` and `/genlockes/new` redirect unauthenticated users to login, then back after auth
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Reviewed-on: https://gitea.nerdboden.de/pokemon/nuzlocke-tracker/pulls/67
Co-authored-by: Julian Tabel <juliantabel.jt@gmail.com>
Co-committed-by: Julian Tabel <juliantabel.jt@gmail.com>
2026-03-21 11:44:05 +01:00
|
|
|
- [x] Replace static \`navLinks\` array with dynamic links based on \`useAuth()\` state
|
|
|
|
|
- [x] **Logged out**: Home, Runs, Genlockes, Stats (no New Run, no Admin)
|
|
|
|
|
- [x] **Logged in (non-admin)**: New Run, My Runs, Genlockes, Stats
|
|
|
|
|
- [x] **Logged in (admin)**: New Run, My Runs, Genlockes, Stats, Admin
|
|
|
|
|
- [x] Update both desktop and mobile nav (they share the same \`navLinks\` array, so this should be automatic)
|
|
|
|
|
- [x] Verify menu updates reactively on login/logout
|
2026-03-21 11:06:53 +01:00
|
|
|
|
|
|
|
|
## Files to change
|
|
|
|
|
|
|
|
|
|
- \`frontend/src/components/Layout.tsx\` — make \`navLinks\` dynamic based on auth state
|
feat: auth-aware UI and role-based access control (#67)
## Summary
- Add `is_admin` column to users table with Alembic migration and a `require_admin` FastAPI dependency that protects all admin-facing write endpoints (games, pokemon, evolutions, bosses, routes CRUD)
- Expose admin status to frontend via user API and update AuthContext to fetch/store `isAdmin` after login
- Make navigation menu auth-aware (different links for logged-out, logged-in, and admin users) and protect frontend routes with `ProtectedRoute` and `AdminRoute` components, preserving deep-linking through redirects
- Fix test reliability: `drop_all` before `create_all` to clear stale PostgreSQL enums from interrupted test runs
- Fix test auth: add `admin_client` fixture and use valid UUID for mock user so tests pass with new admin-protected endpoints
## Test plan
- [x] All 252 backend tests pass
- [ ] Verify non-admin users cannot access admin write endpoints (games, pokemon, evolutions, bosses CRUD)
- [ ] Verify admin users can access admin endpoints normally
- [ ] Verify navigation shows correct links for logged-out, logged-in, and admin states
- [ ] Verify `/admin/*` routes redirect non-admin users with a toast
- [ ] Verify `/runs/new` and `/genlockes/new` redirect unauthenticated users to login, then back after auth
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Reviewed-on: https://gitea.nerdboden.de/pokemon/nuzlocke-tracker/pulls/67
Co-authored-by: Julian Tabel <juliantabel.jt@gmail.com>
Co-committed-by: Julian Tabel <juliantabel.jt@gmail.com>
2026-03-21 11:44:05 +01:00
|
|
|
|
|
|
|
|
## Summary of Changes
|
|
|
|
|
|
|
|
|
|
- Removed static `navLinks` array from module scope
|
|
|
|
|
- Added dynamic `navLinks` computation inside `Layout` component using `useMemo`
|
|
|
|
|
- Navigation now depends on `user` and `isAdmin` from `useAuth()`:
|
|
|
|
|
- Logged out: Home, Runs, Genlockes, Stats
|
|
|
|
|
- Logged in (non-admin): New Run, My Runs, Genlockes, Stats
|
|
|
|
|
- Logged in (admin): New Run, My Runs, Genlockes, Stats, Admin
|
|
|
|
|
- Updated `isActive` function to handle Home route (`/`) correctly
|
|
|
|
|
- Both desktop and mobile nav automatically use the same dynamic `navLinks` array
|