User page · Permissions

1 module · 2 exports · 1 repository · 14 e2e tests · 16 routes

OverviewModulesRepositoriesPermissionsSearch params & storageE2E tests

Who may do what in User page: the per-object permissions it builds with every place checking them, and the checks in its code. See Permissions for how authorization works and the reference for every role and feature.

Other features' permissions

Checks in this feature's code of permissions another feature grants.

Permission	Granted in	Checked in
EDIT	Art	Serveru.$identifier.art.server.ts
EDIT	Builds	Either sideu.$identifier.builds.tsx

Global roles

The global roles this feature's code checks, see who has each.

Role	Checked in
ARTIST	Clientu.$identifier.edit.tsx
STAFF	Serveru.$identifier.admin.server.tsu.$identifier.admin.server.ts Clientu.$identifier.seasons.tsxu.$identifier.tsx
SUPPORTER	ClientWidgetSettingsForm.tsxu.$identifier.edit-widgets.tsxu.$identifier.edit.tsx

Outside the system

Reading x.permissions.NAME directly skips hasPermission and with it the admin bypass, and authorizing an action on an object with isAdmin and friends is a bug. Some of these are deliberate, the permissions doc lists the boundaries.

• isSupporter in app/features/user-page/UserRepository.server.ts:307 isSupporter({ patronTier: rows[0]!.patronTier }),
• isSupporter in app/features/user-page/actions/u.$identifier.edit-widgets.server.ts:11 { body: async () => widgetsEditSchema(isSupporter(requireUser())) },
• isSupporter in app/features/user-page/core/badge-sorting.server.ts:23 const effectiveFavoriteIds = isSupporter({ patronTier })
• isSupporter in app/features/user-page/core/trophy-sorting.server.ts:36 filteredFavoriteIds = isSupporter({ patronTier })
• isSupporter in app/features/user-page/routes/short.$customUrl.ts:9 if (!user || !isSupporter(user)) {