Show Secrets to superusers only, and guard its route as Admin is

The page reads GET /secrets/, which is a superuser's, so any other account opened it onto a permission error.
2026-10-06 12:33:00 +02:00
parent 07d62e3ae6
commit 8a1685741b
2 changed files with 14 additions and 3 deletions
@@ -70,9 +70,11 @@ export function AppSidebar() {
  // depend on where the caret happens to be.
  useShortcuts({ "mod+k": () => setSearchOpen((open) => !open) }, ["mod+k"])

+  // Secrets and Admin are a superuser's: anyone else would open them onto a
+  // permission error.
  const withAdmin = currentUser?.is_superuser
    ? [...baseItems, { icon: Users, title: "Admin", path: "/admin" }]
-    : baseItems
+    : baseItems.filter((item) => item.path !== "/secrets")

  // Reached through a portal, the way out is back to the instances list —
  // and the session belongs to the portal, so logging out is its business.