fix(GRO-1822): add role check before /admin redirect — customers access portal #30

2026-05-27T01:01:53Z

The Dogfather commented

2026-05-27 01:01:53 +00:00

Summary

App.tsx now checks session.user.role === "staff" before redirecting authenticated users to /admin
Customers (any role other than staff) can access the customer portal at /
Impersonation flow via ?sessionId= is preserved

Root Cause

App.tsx lines 389-393 redirected all authenticated users to /admin, regardless of role. When a customer logged in via Authentik SSO, they were caught in this redirect and couldn't access their portal.

Fix

Added role check:

const isStaff = session?.user && (session.user as any).role === "staff";
if (!authDisabled && session && !location.pathname.startsWith("/admin") && !searchParams.has("sessionId") && isStaff) {
  return <Navigate to="/admin" replace />;
}

This ensures:

Staff users → /admin ✓
Customer users → portal at / ✓
Impersonation sessions → work as before ✓

Test Plan

Login via Authentik as a customer account → verify portal at / (not /admin)
Login via Authentik as a staff account → verify redirect to /admin
Impersonation flow with ?sessionId= still works
All existing tests pass

🤖 Generated with Claude Code

## Summary - App.tsx now checks `session.user.role === "staff"` before redirecting authenticated users to `/admin` - Customers (any role other than `staff`) can access the customer portal at `/` - Impersonation flow via `?sessionId=` is preserved ## Root Cause App.tsx lines 389-393 redirected **all** authenticated users to `/admin`, regardless of role. When a customer logged in via Authentik SSO, they were caught in this redirect and couldn't access their portal. ## Fix Added role check: ```typescript const isStaff = session?.user && (session.user as any).role === "staff"; if (!authDisabled && session && !location.pathname.startsWith("/admin") && !searchParams.has("sessionId") && isStaff) { return <Navigate to="/admin" replace />; } ``` This ensures: - Staff users → `/admin` ✓ - Customer users → portal at `/` ✓ - Impersonation sessions → work as before ✓ ## Test Plan - [ ] Login via Authentik as a customer account → verify portal at `/` (not `/admin`) - [ ] Login via Authentik as a staff account → verify redirect to `/admin` - [ ] Impersonation flow with `?sessionId=` still works - [ ] All existing tests pass 🤖 Generated with [Claude Code](https://claude.com/claude-code)

The Dogfather added 1 commit 2026-05-27 01:01:53 +00:00

fix(GRO-1822): add role check before /admin redirect — customers access portal

CI / Test (pull_request) Failing after 14s

Details

CI / Lint & Typecheck (pull_request) Failing after 17s

Details

CI / Build & Push Docker Image (pull_request) Has been skipped

Details

4e487db6f1

App.tsx lines 389-393 redirected ALL authenticated users to /admin,
breaking customer portal access after SSO login.

Now checks `session.user.role === "staff"` before redirecting.
Customers (role !== "staff") can access the portal at /.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

The Dogfather merged commit 9a3b5d88c8 into dev

2026-05-27 01:02:00 +00:00

The Dogfather referenced this pull request

2026-05-29 08:35:18 +00:00

fix(App.tsx): check user role before redirecting to /admin #29

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: groombook/web#30