fix: secure admin pages with server-side authentication and role-based access#845
Merged
jeromehardaway merged 2 commits intomasterfrom Dec 31, 2025
Merged
fix: secure admin pages with server-side authentication and role-based access#845jeromehardaway merged 2 commits intomasterfrom
jeromehardaway merged 2 commits intomasterfrom
Conversation
…d access BREAKING CHANGES: - Admin pages now require server-side authentication - Hardcoded admin email replaced with database role checks - All admin access now requires ADMIN role from database Security Improvements: - Convert all admin pages from getStaticProps to getServerSideProps - Add server-side authentication checks before rendering admin pages - Block unauthorized access at server level (not client-side) - Replace hardcoded 'jeromehardaway' email with role-based checks Pages Updated: - admin/users.tsx: Fetch real user data from database, added role badges - admin/courses.tsx: Fetch real course data with enrollment counts - admin/index.tsx: Display real dashboard statistics, remove dev-session - admin/blog-images.tsx: Add server-side auth protection - courses/index.tsx: Use role check for admin dashboard link Database Integration: - admin/users: Query users with enrollment counts - admin/courses: Query courses with module/enrollment counts - admin/index: Aggregate platform statistics from database This fixes critical security vulnerability where admin pages were: 1. Publicly accessible as static pages 2. Using client-side auth checks (bypassable) 3. Displaying mock data instead of real database data 4. Hardcoding admin access to single GitHub user
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
There was a problem hiding this comment.
Pull request overview
This PR implements critical security improvements by replacing hardcoded admin authentication with role-based access control and converting client-side admin pages to server-side rendering with proper authentication checks.
Key Changes:
- Replaced hardcoded email check with database role-based authentication system
- Converted all admin pages from
getStaticPropstogetServerSidePropsfor server-side protection - Integrated real database queries to replace mock data across admin pages
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| src/pages/courses/index.tsx | Updated admin access check from hardcoded email to role-based verification |
| src/pages/admin/users.tsx | Converted to server-side rendering with database integration for user management |
| src/pages/admin/index.tsx | Replaced mock statistics with real database aggregations and removed dev-session logic |
| src/pages/admin/courses.tsx | Implemented server-side authentication and real course data from database |
| src/pages/admin/blog-images.tsx | Added server-side authentication protection to replace client-side checks |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+32
to
+34
| const completionRate = stats.totalEnrollments > 0 | ||
| ? Math.round((stats.completedEnrollments / stats.totalEnrollments) * 100) | ||
| : 0; |
There was a problem hiding this comment.
The completion rate calculation is defined in the component body and will be recalculated on every render. Consider moving this calculation to the server-side in getServerSideProps where the stats are already being computed, or memoize it with useMemo if it needs to be client-side.
|
🔍 Code Quality Score Breakdown:
💡 Recommendations:
|
- Add explicit permissions block for workflow scoping - Use VWC_GITHUB_TOKEN secret instead of default GITHUB_TOKEN - Fixes build failure when fetching GitHub project data
|
🔍 Code Quality Score Breakdown:
💡 Recommendations:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
BREAKING CHANGES:
Security Improvements:
Pages Updated:
Database Integration:
This fixes critical security vulnerability where admin pages were: