From 505904d8bd8821afd231a81243b861d96f431a42 Mon Sep 17 00:00:00 2001 From: Flea Flicker Date: Wed, 27 May 2026 00:53:16 +0000 Subject: [PATCH] fix(App.tsx): check user role before redirecting to /admin - Staff users (role !== "customer") continue to redirect to /admin - Customer users (role === "customer") see the portal at / instead - Impersonation flow via ?sessionId= remains unaffected - Dev mode (authDisabled=true) unchanged Refs: GRO-1822 --- src/App.tsx | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/src/App.tsx b/src/App.tsx index ea51314..37e06ef 100644 --- a/src/App.tsx +++ b/src/App.tsx @@ -386,9 +386,10 @@ export function App() { return ; } - // Redirect authenticated users to /admin (but preserve impersonation flow via ?sessionId=) + // Redirect authenticated staff (non-customer) users to /admin (but preserve impersonation flow via ?sessionId=) const searchParams = new URLSearchParams(location.search); - if (!authDisabled && session && !location.pathname.startsWith("/admin") && !searchParams.has("sessionId")) { + // eslint-disable-next-line @typescript-eslint/no-explicit-any -- Better Auth session.user extends Record; role field is injected by Authentik OIDC + if (!authDisabled && session && (session as any)?.user?.role !== "customer" && !location.pathname.startsWith("/admin") && !searchParams.has("sessionId")) { return ; }