From 9e84c400ed5b52c82be077c7cae0ca6d754feebc Mon Sep 17 00:00:00 2001
From: Agent Zero <agent@media-on.de>
Date: Sun, 23 Aug 2026 22:31:04 +0200
Subject: [PATCH] fix(c5,arch-021): system dashboard nav entry only for system
 admins

---
 frontend/src/components/layout/Sidebar.tsx | 24 +++++++++++++---------
 1 file changed, 14 insertions(+), 10 deletions(-)

diff --git a/frontend/src/components/layout/Sidebar.tsx b/frontend/src/components/layout/Sidebar.tsx
index 4f78e87..8fb3bb4 100644
--- a/frontend/src/components/layout/Sidebar.tsx
+++ b/frontend/src/components/layout/Sidebar.tsx
@@ -79,16 +79,20 @@ export function Sidebar() {
   };
 
   const allMenuItems = useMemo(() => {
-    const staticItems = singleItems.map(item => ({
-      path: item.to,
-      labelKey: item.labelKey,
-      label: item.labelKey,
-      icon: item.icon,
-      order: item.order,
-      group: undefined as string | undefined,
-      isStatic: true as const,
-      permission: item.to === '/dashboard' ? 'dashboard:read' : item.to === '/contacts' ? 'contacts:read' : undefined,
-    }));
+    const staticItems = singleItems
+      // Backend enforces require_admin on system dashboard routes — hide the
+      // nav entry from non-admin users instead of showing a dead link.
+      .filter(item => item.to !== '/system-dashboard' || user?.is_system_admin)
+      .map(item => ({
+        path: item.to,
+        labelKey: item.labelKey,
+        label: item.labelKey,
+        icon: item.icon,
+        order: item.order,
+        group: undefined as string | undefined,
+        isStatic: true as const,
+        permission: item.to === '/dashboard' ? 'dashboard:read' : item.to === '/contacts' ? 'contacts:read' : undefined,
+      }));
 
     const pluginItems = (manifests || [])
       .flatMap((m) => (Array.isArray(m.menu_items) ? m.menu_items : []))