feat: Role-Based Access Control (RBAC) and Admin Dashboard#387
Open
swetalin-10 wants to merge 3 commits into
Open
feat: Role-Based Access Control (RBAC) and Admin Dashboard#387swetalin-10 wants to merge 3 commits into
swetalin-10 wants to merge 3 commits into
Conversation
Backend:
- user.model.js: add role field ('user'|'admin', default 'user')
- adminMiddleware.js: new middleware - 403 if req.user.role !== 'admin'
- authMiddleware.js: expose role on req.user
- product.route.js: protect POST/PUT/PATCH/DELETE with authMiddleware + adminMiddleware
- auth.controller.js: include role in login response payload
Frontend:
- AdminRoute.jsx: redirects non-admins to / and guests to /login
- AdminDashboardPage.jsx: product table with Edit/Delete/Add; edit and
add open a modal form that calls updateProduct/createProduct from store
- App.jsx: /admin route wrapped in AdminRoute
- Navbar.jsx: Dashboard button visible only when role === 'admin'
|
@swetalin-10 is attempting to deploy a commit to the niharika-mente's projects Team on Vercel. A member of the Team first needs to authorize it. |
Resolved conflicts: - user.model.js: kept role + added resetPasswordToken/resetPasswordExpires from upstream - adminMiddleware.js: identical logic, kept ours (quote style difference) - App.jsx: kept AdminRoute for /admin, added forgot/reset-password routes from upstream, removed duplicate import - Navbar.jsx: identical logic, kept ours (quote style difference) - AdminDashboardPage.jsx: kept our CRUD product table (issue niharika-mente#179); upstream analytics dashboard is a separate feature from niharika-mente#374 - admin-dashboard.png: kept ours
Aamod-Dev
requested changes
Jun 21, 2026
Aamod-Dev
left a comment
Aamod-Dev
left a comment
Collaborator
There was a problem hiding this comment.
Needs changes: There are merge conflicts. Please resolve them.
Resolved 3 conflicts: App.jsx: upstream added duplicate AdminDashboardPage import + ReferralDashboardPage. Dropped the duplicate, kept ReferralDashboardPage (route already present). Navbar.jsx (1): dropped stale localStorage-polling useEffect from HEAD — auth state is read from useAuth() context, no polling needed. Navbar.jsx (2): Dashboard button style — kept upstream variant=ghost for consistency with rest of nav.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #179
Overview
Adds a
rolefield to users, an admin middleware that gates write operations on products, and a protected/admindashboard where admins can view, create, edit, and delete inventory.Backend changes
BACKEND/models/user.model.jsAdded
role: { type: String, enum: ['user', 'admin'], default: 'user' }. All existing users default to'user'— no migration needed.BACKEND/middleware/adminMiddleware.js(new)Returns
403 Access deniedifreq.user.role !== 'admin'. Chained afterauthMiddlewareso the user is already verified.BACKEND/middleware/authMiddleware.jsExposes
roleonreq.userso downstream middleware can inspect it.BACKEND/routes/product.route.jsPOST /,PUT /:id,PATCH /:id/restock, andDELETE /:idnow requireauthMiddleware→adminMiddleware.GETroutes remain public.BACKEND/controllers/auth.controller.jsLogin response now includes
rolein the user payload so the frontend can store it and gate UI.Frontend changes
FRONTEND/src/components/AdminRoute.jsx(new)Reads
authTokenandauthUserfromlocalStorage. Redirects guests to/loginand non-admins to/. Admins pass through.FRONTEND/src/pages/AdminDashboardPage.jsx(new)updateProductfrom the existing product storedeleteProductcreateProductFRONTEND/src/App.jsxAdded
<Route path="/admin" element={<AdminRoute><AdminDashboardPage /></AdminRoute>} />.FRONTEND/src/components/ui/Navbar.jsxA Dashboard button (purple outline) appears in the nav only when
authUser.role === 'admin'.Screenshot
How to test
role: 'admin'on that document./adminto see the product table.POST /api/productswithout a token or with a non-admin token →403./adminwhile logged in as a regular user → redirected to/.