Repository navigation
Use role permissions wherever staff were checked as super admins - #588
Merged
simonhamp merged 2 commits intoOct 29, 2026
Merged
Conversation
The "View Listing Page" button on the plugin admin page links to the public plugin page, which only let super admins and the owner see a plugin that isn't approved and active. Staff whose role grants View:Plugin saw the button but got a 404. Check the plugin view permission instead, on both the plugin page and its license page. Super admins keep access through the gate; customers without the permission still get a 404. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
After roles shipped, several places still only let super admins in, so staff with the right permission saw a button or link and then got a 404 or 403: - Article "Preview" on drafts now needs View:Article - Support ticket attachments open for anyone who can view the ticket - Replies from any staff member get the "Staff" badge, via a new User::isStaff() Links from one admin section to another (user, subscription, payout, plugin, course module) are now hidden when the role can't open the target, instead of leading to a 403. While there, fix the user link on subscription items and the wall of love "user" action, which passed the wrong record id. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Follow-up to #555. Some places still only let super admins in, so staff whose role had the right permission saw a button or link in the admin and then got a 404 or 403.
Fixes
View:Plugin, with the preview bannerView:ArticleSupportTicketPolicy::view)User::isStaff()Customers without permissions keep getting a 404/403 as before. Super admins are unaffected.
Also fixes two links that passed the wrong record id: the user link on a subscription item (used the subscription id) and the wall of love "user" action (used the submission id).
Deliberately left super-admin only
Horizon, admin MCP tools, reserved plugin namespaces, plugin access via the API, Roles page, role assignment, impersonation.
Testing
AdminPluginPreviewTest: 4 new tests (staff with/withoutView:Plugin, paid plugin + license page,super_adminrole).AdminRolesAndPermissionsTest: 7 new tests (article draft preview, ticket attachments,isStaff(), cross-section links hidden/shown, "Go to User" action).PluginCategoriesTesttests that need the Imagick extension (missing locally, unrelated).