nate/weather
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Dashboard: always show Settings link; non-admins get an explanation of their role

Browse Source 
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
This commit is contained in:
Nate EmmertandClaude Sonnet 5.5 committed 2026-10-16 07:34:32 -04:00
1 parent 2efc945192
commit dee245ea27
2 files changed
+6 -3
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

app/server.js
+5 -1
View File
@@ -1575,7 +1575,11 @@ app.get('/dashboard', requireDashboardAuth, (_req, res) => {
app.get('/dashboard/account', requireDashboardAuth, (_req, res) => {
sendHtml(res, 'dashboard-account.html');
});
app.get('/dashboard/settings', requireDashboardAuth, requireAdmin, (_req, res) => {
app.get('/dashboard/settings', requireDashboardAuth, (req, res) => {
if (req.dashUser.role !== 'admin') {
const esc = (t) => String(t).replace(/[&<>"]/g, c => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;' }[c]));
return res.status(403).send(`<!doctype html><meta name="viewport" content="width=device-width,initial-scale=1"><body style="font-family:system-ui;max-width:32rem;margin:3rem auto;padding:0 1rem"><h2>Settings are admin-only</h2><p>You are signed in as <b>${esc(req.dashUser.username)}</b> (role: <b>${esc(req.dashUser.role || 'none')}</b>).</p><p>Sign out and sign in with your admin account, or ask an admin to change your role on the Account page.</p><p><a href="/dashboard/account">Account</a> &middot; <a href="/dashboard/logout">Sign out</a> &middot; <a href="/dashboard">Dashboard</a></p>`);
}
sendHtml(res, 'dashboard-settings.html');
});