[christmas] Hide "Manage" nav link from viewers and tighten API allowlist to exact names

[gazure]

Hide the "Manage" nav link from viewers and show a friendly gate on the admin page

Previously, anyone signed in with the family (viewer) password could see the "Manage" link in the navbar and click through to a page full of permission errors. This tightens that up in two places:

• Navbar: The "Manage" link is now only rendered when the current user has the Manager role, fetched via my_role on shell load.
• Admin page: Rather than immediately firing off all its data-fetching resources (which would return 403s for viewers), the page now checks the role first. Managers see the full manage UI (moved into ManageBody); viewers see a friendly message explaining they need the manager password, with a direct link to sign in as manager.

The server-side middleware remains the true enforcement boundary — this is purely a UX improvement so viewers aren't greeted with a wall of errors.

Auth allowlist fix

The previous viewer endpoint check used starts_with("list_"), which inadvertently granted viewers access to list_participants, list_relationships, list_memberships, list_excluded_letters, and list_all_excluded_letters — data that should only be visible to managers. The allowlist is now an explicit set of named endpoints matched after stripping the Dioxus-appended numeric hash suffix, so only the intended six endpoints are viewer-accessible. New tests cover exact-name matching, hash stripping, and the specific case where list_exchanges and list_excluded_letters share a long common prefix.

[gazure]

• [christmas] Hide "Manage" nav link from viewers and tighten API allowlist to exact names #390 👈 (View in Graphite)
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[gazure]

Merge activity

• Jul 25, 4:32 PM UTC: @gazure merged this pull request with Graphite.