phase1: RLS simplified to tenant isolation only + canAccess fallback removed + useUserPermissions hook + security kernel docs

2026-07-29 16:36:51 +02:00
parent 66fd387301
commit 8da803156e
9 changed files with 222 additions and 16 deletions
@@ -45,12 +45,9 @@ export function Sidebar() {
  const { hasPermission } = usePermission();
  const user = useAuthStore((state) => state.user);

-  // Fallback: system admin or empty permissions = show everything
+  // Use hasPermission directly — permissions are loaded via useUserPermissions hook
  const canAccess = (perm?: string): boolean => {
    if (!perm) return true;
-    if (user?.is_system_admin) return true;
-    const perms = user?.permissions || [];
-    if (perms.length === 0) return true; // No permissions loaded — show all, backend 403 handles it
    return hasPermission(perm);
  };