[Supplier] Phase 2: Admin-Only Route Guard & Navigation Integration #196

New issue

Closed

opened 2026-10-03 23:22:23 +00:00 by yuris · 0 comments

yuris commented

2026-10-03 23:22:23 +00:00

Owner

Overview

Enforce strict admin-only boundary protection for the supplier feature across routing, server components, server actions, and navigation components.

Principles Applied

principle-boundary-discipline: Strict server-side role validation at system boundaries.
principle-laziness-protocol: Reuse existing requireAdmin() helper from @/lib/auth/guard.

Scope & Tasks

Wrap /suppliers route segment in apps/management/app/(dashboard)/suppliers/layout.tsx with requireAdmin().
Add "Supplier" to desktop navigation and mobile bottom bar in apps/management/components/dashboard-nav.tsx, conditionally visible only when user?.role === "admin".
Guard all supplier mutations in apps/management/lib/suppliers/actions.ts with requireAdmin().
Redirect or return 403 Forbidden for non-admin users attempting to access /suppliers.

Acceptance Criteria

Admin users see "Supplier" in sidebar/mobile bar and can access /suppliers.
Non-admin users (operators/managers) cannot see the link and are blocked with 403 on direct access.
pnpm verify:management passes.

### Overview Enforce strict admin-only boundary protection for the supplier feature across routing, server components, server actions, and navigation components. ### Principles Applied - `principle-boundary-discipline`: Strict server-side role validation at system boundaries. - `principle-laziness-protocol`: Reuse existing `requireAdmin()` helper from `@/lib/auth/guard`. ### Scope & Tasks - Wrap `/suppliers` route segment in `apps/management/app/(dashboard)/suppliers/layout.tsx` with `requireAdmin()`. - Add "Supplier" to desktop navigation and mobile bottom bar in `apps/management/components/dashboard-nav.tsx`, conditionally visible only when `user?.role === "admin"`. - Guard all supplier mutations in `apps/management/lib/suppliers/actions.ts` with `requireAdmin()`. - Redirect or return 403 Forbidden for non-admin users attempting to access `/suppliers`. ### Acceptance Criteria - [x] Admin users see "Supplier" in sidebar/mobile bar and can access `/suppliers`. - [x] Non-admin users (operators/managers) cannot see the link and are blocked with 403 on direct access. - [x] `pnpm verify:management` passes.

yuris changed title from ~~[Pemasok] Phase 2: Admin-Only Route Guard & Navigation Integration~~ to [Supplier] Phase 2: Admin-Only Route Guard & Navigation Integration

2026-10-03 23:23:16 +00:00

yuris referenced this issue from a commit

2026-10-03 23:49:00 +00:00

feat(suppliers): admin-only route guard and navigation integration (#196)

yuris referenced this issue from a pull request that will close it,

2026-10-03 23:49:02 +00:00

feat(suppliers): admin-only route guard and navigation integration (#196) #202

yuris closed this issue

2026-10-03 23:52:27 +00:00

yuris referenced this issue from a commit

2026-10-03 23:52:28 +00:00

feat(suppliers): admin-only route guard and navigation integration (#196)