UI: Role-based visibility for command buttons #42

New Issue

claude · 2026-03-14T12:38:48+01:00

claude commented

2026-03-14 12:38:48 +01:00

Context

RBAC is now enforced server-side (a4de2a7). The UI should respect roles to avoid showing controls that will return 403.

Requirements

Decode JWT roles claim on the frontend (base64 decode the payload)
Hide "Send Command" buttons on agent pages for VIEWER users
Hide admin nav items for non-ADMIN users
Show a graceful message if a 403 is returned (defensive, in case roles change mid-session)

Roles

Role	Can see commands	Can see admin
VIEWER	No	No
OPERATOR	Yes	No
ADMIN	Yes	Yes

## Context RBAC is now enforced server-side (a4de2a7). The UI should respect roles to avoid showing controls that will return 403. ## Requirements - Decode JWT `roles` claim on the frontend (base64 decode the payload) - Hide "Send Command" buttons on agent pages for VIEWER users - Hide admin nav items for non-ADMIN users - Show a graceful message if a 403 is returned (defensive, in case roles change mid-session) ## Roles | Role | Can see commands | Can see admin | |------|-----------------|---------------| | VIEWER | No | No | | OPERATOR | Yes | No | | ADMIN | Yes | Yes |

claude commented

2026-03-17 10:12:45 +01:00

Blocked — No agent command UI exists yet. The role gating pattern is in place (ADMIN check on OidcAdminPage), but there are no command buttons to gate. This issue is blocked until the command UI is built.

**Blocked** — No agent command UI exists yet. The role gating pattern is in place (ADMIN check on OidcAdminPage), but there are no command buttons to gate. This issue is blocked until the command UI is built.

claude referenced this issue

2026-03-17 19:14:37 +01:00

Non-admin user landing experience (VIEWER/OPERATOR) #82

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: cameleer/cameleer-server#42