Merge SEC-09: hide admin nav links from non-admin users

# Conflicts: # internal/ui/ui_test.go
2026-03-13 01:06:50 -07:00
parent 6191c5e00a d7d7ba21d9
commit bef5a3269d
8 changed files with 142 additions and 14 deletions
--- a/internal/ui/handlers_auth.go
+++ b/internal/ui/handlers_auth.go
@@ -283,6 +283,7 @@ func (u *UIServer) handleProfilePage(w http.ResponseWriter, r *http.Request) {
 		PageData: PageData{
 			CSRFToken: csrfToken,
 			ActorName: u.actorName(r),
+			IsAdmin:   isAdmin(r),
 		},
 	})
 }
@@ -395,6 +396,7 @@ func (u *UIServer) handleSelfChangePassword(w http.ResponseWriter, r *http.Reque
 		PageData: PageData{
 			CSRFToken: csrfToken,
 			ActorName: u.actorName(r),
+			IsAdmin:   isAdmin(r),
 			Flash:     "Password updated successfully. Other active sessions have been revoked.",
 		},
 	})