hotfix: sidebar + topbar canAccess fallback — show all items for system_admin or empty permissions

frontend/src/components/layout/Sidebar.tsx

@@ -42,6 +42,16 @@ export function Sidebar() {
   const manifests = usePluginStore(s => s.manifests);
   const { data: menuOrderData } = useMenuOrder();
   const { hasPermission } = usePermission();
+  const user = useAuthStore((state) => state.user);
+
+  // Fallback: system admin or empty permissions = show everything
+  const canAccess = (perm?: string): boolean => {
+    if (!perm) return true;
+    if (user?.is_system_admin) return true;
+    const perms = user?.permissions || [];
+    if (perms.length === 0) return true; // No permissions loaded — show all, backend 403 handles it
+    return hasPermission(perm);
+  };
 
   const allMenuItems = useMemo(() => {
     const staticItems = singleItems.map(item => ({
@@ -57,7 +67,7 @@ export function Sidebar() {
 
     const pluginItems = manifests
       .flatMap((m) => m.menu_items)
-      .filter(item => !item.permission || hasPermission(item.permission))
+      .filter(item => !item.permission || canAccess(item.permission))
       .map(item => ({
         path: item.path,
         labelKey: item.label_key,
@@ -94,7 +104,7 @@ export function Sidebar() {
       if (a.order !== b.order) return a.order - b.order;
       return a.label.localeCompare(b.label);
     });
-  }, [manifests, menuOrderData]);
+  }, [manifests, menuOrderData, user]);
 
   const [expandedItems, setExpandedItems] = useState<Set<string>>(new Set());
 
@@ -158,7 +168,7 @@ export function Sidebar() {
               const elements: React.ReactNode[] = [];
               for (const item of singles) {
                 // Skip if user lacks permission
-                if (item.permission && !hasPermission(item.permission)) continue;
+                if (item.permission && !canAccess(item.permission)) continue;
                 elements.push(
                   <li key={item.path}>
                     <NavLink
@@ -183,7 +193,7 @@ export function Sidebar() {
               }
               for (const [group, items] of groups) {
                 // Filter group items by permission
-                const visibleItems = items.filter(item => !item.permission || hasPermission(item.permission));
+                const visibleItems = items.filter(item => !item.permission || canAccess(item.permission));
                 if (visibleItems.length === 0) continue; // Hide empty groups
                 const groupKey = `plugin-group-${group}`;
                 const expanded = expandedItems.has(groupKey);