From b086d5d22bd970fe80555a6db9466eedc69f7b03 Mon Sep 17 00:00:00 2001
From: stroblme <stroblme@posteo.de>
Date: Tue, 6 Oct 2026 12:33:00 +0200
Subject: [PATCH] Show Secrets to superusers only, and guard its route as Admin
 is

The page reads GET /secrets/, which is a superuser's, so any other account
opened it onto a permission error.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013GAeg4Jo6xjZzjwy9QDWMQ
---
 frontend/src/components/Sidebar/AppSidebar.tsx |  4 +++-
 frontend/src/routes/_layout/secrets.tsx        | 13 +++++++++++--
 2 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/frontend/src/components/Sidebar/AppSidebar.tsx b/frontend/src/components/Sidebar/AppSidebar.tsx
index a85a79d..a741a1b 100644
--- a/frontend/src/components/Sidebar/AppSidebar.tsx
+++ b/frontend/src/components/Sidebar/AppSidebar.tsx
@@ -70,9 +70,11 @@ export function AppSidebar() {
   // depend on where the caret happens to be.
   useShortcuts({ "mod+k": () => setSearchOpen((open) => !open) }, ["mod+k"])
 
+  // Secrets and Admin are a superuser's: anyone else would open them onto a
+  // permission error.
   const withAdmin = currentUser?.is_superuser
     ? [...baseItems, { icon: Users, title: "Admin", path: "/admin" }]
-    : baseItems
+    : baseItems.filter((item) => item.path !== "/secrets")
 
   // Reached through a portal, the way out is back to the instances list —
   // and the session belongs to the portal, so logging out is its business.
diff --git a/frontend/src/routes/_layout/secrets.tsx b/frontend/src/routes/_layout/secrets.tsx
index b462dbd..b244d98 100644
--- a/frontend/src/routes/_layout/secrets.tsx
+++ b/frontend/src/routes/_layout/secrets.tsx
@@ -1,9 +1,9 @@
 import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query"
-import { createFileRoute } from "@tanstack/react-router"
+import { createFileRoute, redirect } from "@tanstack/react-router"
 import { KeyRound, Plus, Trash2 } from "lucide-react"
 import { useState } from "react"
 
-import { SecretsService } from "@/client"
+import { SecretsService, UsersService } from "@/client"
 import { Button } from "@/components/ui/button"
 import {
   Dialog,
@@ -19,6 +19,15 @@ import { handleError } from "@/utils"
 
 export const Route = createFileRoute("/_layout/secrets")({
   component: Secrets,
+  // `GET /secrets/` is a superuser's, as Admin is.
+  beforeLoad: async () => {
+    const user = await UsersService.readUserMe()
+    if (!user.is_superuser) {
+      throw redirect({
+        to: "/",
+      })
+    }
+  },
   head: () => ({
     meta: [
       {