From 62eaef2f539a33bf92d06c78421628f98974faaf Mon Sep 17 00:00:00 2001 From: c0mrade Date: Tue, 26 May 2026 15:18:21 +0300 Subject: [PATCH] =?UTF-8?q?fix(permission-route):=20guard=20against=20/adm?= =?UTF-8?q?in=20=E2=86=92=20/admin=20redirect=20loop?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit PermissionRoute unconditionally sent permission-failing users to /admin. The current router wraps /admin in AdminRoute (no permission check), so this never triggered. But if /admin ever picks up a PermissionRoute guard — even by accident in a future change — the user would loop on itself with replace history (no back-button escape). Detect that case explicitly: if we're already on /admin and still failing the permission check, fall back to / instead. Costs nothing today, prevents a hard-to-diagnose lock-out later. --- src/components/auth/PermissionRoute.tsx | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/src/components/auth/PermissionRoute.tsx b/src/components/auth/PermissionRoute.tsx index 5b9454b..97c35d8 100644 --- a/src/components/auth/PermissionRoute.tsx +++ b/src/components/auth/PermissionRoute.tsx @@ -58,7 +58,11 @@ export function PermissionRoute({ } if (!hasAccess) { - return ; + // Redirect back to the admin landing — unless we're already there + // (would loop) or the landing itself is what we lack permission for. + // Fall back to the user dashboard in that case. + const target = location.pathname === '/admin' ? '/' : '/admin'; + return ; } }