fix(auth): reject consumer-only admin sessions

2026-09-07 20:08:27 +08:00
parent e3fcaa4d38
commit 2bc5c5df50
6 changed files with 41 additions and 7 deletions
@@ -47,7 +47,9 @@ export const Route = createFileRoute('/_authed/roles')({

 function RolesPage() {
  const canCreate = useCan(PERM.ROLE_CREATE)
-  const canUpdate = useCan(PERM.ROLE_UPDATE)
+  const canUpdateRole = useCan(PERM.ROLE_UPDATE)
+  const canManagePermissions = useCan(PERM.PERMISSION_MANAGE)
+  const canUpdate = canUpdateRole && canManagePermissions
  const canDelete = useCan(PERM.ROLE_DELETE)

  const roles = useQuery({ queryKey: ['roles'], queryFn: fetchRoles })