🐛 Bug Description
The /admin route is wrapped in ProtectedRoute, which only checks if the user is logged in. Any authenticated user (regardless of their UserRole.role) can access the admin panel, create/edit/delete quests, and manage bosses.
📋 Steps to Reproduce
- Register a regular user account
- Navigate to /admin
🎯 Expected Behavior
Only users with role == "Admin" can access /admin. Others get redirected to the home page (/dashboard).
📸 Actual Behavior
Full admin panel is accessible to all logged-in users.
🌍 Environment
All environments.
📎 Additional Context
App.jsx:40. UserRole model already has the role field (user_role.py:19). The /api/me response should include role, and ProtectedRoute (or a separate AdminRoute) should gate on it.
🐛 Bug Description
The /admin route is wrapped in ProtectedRoute, which only checks if the user is logged in. Any authenticated user (regardless of their UserRole.role) can access the admin panel, create/edit/delete quests, and manage bosses.
📋 Steps to Reproduce
🎯 Expected Behavior
Only users with role == "Admin" can access /admin. Others get redirected to the home page (
/dashboard).📸 Actual Behavior
Full admin panel is accessible to all logged-in users.
🌍 Environment
All environments.
📎 Additional Context
App.jsx:40. UserRole model already has the role field (user_role.py:19). The /api/me response should include role, and ProtectedRoute (or a separate AdminRoute) should gate on it.