Several pages stay visible to standard (role=user) accounts so they can view configuration -- Access Lists, Certificates, DNS Providers, Security Headers, Domains, Remote Servers, and the Hecate tunnels page -- but their create/edit/delete buttons are still rendered even though the underlying actions are admin-only as of #1316. A standard user can click them and the request is correctly refused server-side, so this is purely cosmetic, but the failed action is confusing.
Gate these mutation controls in the UI on user.role === 'admin' (reusing the existing pattern used for the Users page and nav) so standard users see a clean read-only view. No API change is needed; the server already returns 403 for these actions.
Follow-up from #1316 / GHSA-3gc6-295r-xm5m.
Several pages stay visible to standard (
role=user) accounts so they can view configuration -- Access Lists, Certificates, DNS Providers, Security Headers, Domains, Remote Servers, and the Hecate tunnels page -- but their create/edit/delete buttons are still rendered even though the underlying actions are admin-only as of #1316. A standard user can click them and the request is correctly refused server-side, so this is purely cosmetic, but the failed action is confusing.Gate these mutation controls in the UI on
user.role === 'admin'(reusing the existing pattern used for the Users page and nav) so standard users see a clean read-only view. No API change is needed; the server already returns 403 for these actions.Follow-up from #1316 / GHSA-3gc6-295r-xm5m.