From 48c710bfbf3cb9bf1aa8017223b4b00cc2062598 Mon Sep 17 00:00:00 2001
From: Sven laptop <sven@huizevanhoof.nl>
Date: Wed, 23 Sep 2026 17:12:41 +0200
Subject: [PATCH] Fix admin check on monitoring UI

---
 error_log_api/index.js    |  2 +-
 monitoring_ui/src/App.jsx | 94 ++++++++++++++++++++++++---------------
 2 files changed, 59 insertions(+), 37 deletions(-)

diff --git a/error_log_api/index.js b/error_log_api/index.js
index 7dda828..b27b49e 100644
--- a/error_log_api/index.js
+++ b/error_log_api/index.js
@@ -58,7 +58,7 @@ function verifyAdmin(req, res, next) {
 
   try {
     const payload = jwt.verify(auth.slice(7), JWT_SECRET);
-    if (!payload?.isAdmin) {
+    if (!payload?.user.isAdmin) {
       return res.status(403).json({ error: toFriendlyError(403) });
     }
 
diff --git a/monitoring_ui/src/App.jsx b/monitoring_ui/src/App.jsx
index da7118b..94c9b0b 100644
--- a/monitoring_ui/src/App.jsx
+++ b/monitoring_ui/src/App.jsx
@@ -57,7 +57,12 @@ const healthPaths = {
   errors: "/health",
 };
 const testerRoutes = [
-  { service: "auth", method: "POST", path: "/login", label: "Login (userCode + password)" },
+  {
+    service: "auth",
+    method: "POST",
+    path: "/login",
+    label: "Login (userCode + password)",
+  },
   { service: "auth", method: "GET", path: "/me", label: "Current session" },
   {
     service: "employee",
@@ -108,8 +113,8 @@ function App() {
   const [token, setToken] = useState(
     () => localStorage.getItem("transit-monitor-token") || "",
   );
-  const [user, setUser] = useState(
-    () => JSON.parse(localStorage.getItem("transit-monitor-user") || "null"),
+  const [user, setUser] = useState(() =>
+    JSON.parse(localStorage.getItem("transit-monitor-user") || "null"),
   );
   const [health, setHealth] = useState({});
   const [history, setHistory] = useState({});
@@ -129,35 +134,38 @@ function App() {
   const [loginLoading, setLoginLoading] = useState(false);
   const [loginError, setLoginError] = useState("");
 
-  const login = useCallback(async (userCode, password) => {
-    const url = urls.auth;
-    if (!url) {
-      setLoginError("Auth API URL not configured");
-      return;
-    }
-    setLoginLoading(true);
-    setLoginError("");
-    try {
-      const response = await fetch(`${url}/login`, {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ userCode, password }),
-      });
-      const data = await response.json();
-      if (!response.ok) {
-        throw new Error(data.error || `HTTP ${response.status}`);
+  const login = useCallback(
+    async (userCode, password) => {
+      const url = urls.auth;
+      if (!url) {
+        setLoginError("Auth API URL not configured");
+        return;
       }
-      setToken(data.token);
-      setUser(data.user);
-      localStorage.setItem("transit-monitor-token", data.token);
-      localStorage.setItem("transit-monitor-user", JSON.stringify(data.user));
+      setLoginLoading(true);
       setLoginError("");
-    } catch (error) {
-      setLoginError(error.message);
-    } finally {
-      setLoginLoading(false);
-    }
-  }, [urls.auth]);
+      try {
+        const response = await fetch(`${url}/login`, {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ userCode, password }),
+        });
+        const data = await response.json();
+        if (!response.ok) {
+          throw new Error(data.error || `HTTP ${response.status}`);
+        }
+        setToken(data.token);
+        setUser(data.user);
+        localStorage.setItem("transit-monitor-token", data.token);
+        localStorage.setItem("transit-monitor-user", JSON.stringify(data.user));
+        setLoginError("");
+      } catch (error) {
+        setLoginError(error.message);
+      } finally {
+        setLoginLoading(false);
+      }
+    },
+    [urls.auth],
+  );
 
   const logout = useCallback(() => {
     setToken("");
@@ -590,7 +598,9 @@ function Docs() {
                 <summary>API Routes</summary>
                 <ul>
                   {meta.routes.map((route) => (
-                    <li key={route}><code>{route}</code></li>
+                    <li key={route}>
+                      <code>{route}</code>
+                    </li>
                   ))}
                 </ul>
               </details>
@@ -855,7 +865,11 @@ function Connections({ urls, token, user, login, logout, save, loginLoading }) {
               />
             </label>
             {loginError && <div className="login-error">{loginError}</div>}
-            <button type="submit" className="run-button save-button" disabled={loginLoading}>
+            <button
+              type="submit"
+              className="run-button save-button"
+              disabled={loginLoading}
+            >
               {loginLoading ? "Logging in..." : "Login"}
             </button>
           </form>
@@ -898,10 +912,18 @@ function Connections({ urls, token, user, login, logout, save, loginLoading }) {
       </div>
       <div className="user-info">
         <h3>Logged in as</h3>
-        <p><strong>User Code:</strong> {user?.userCode}</p>
-        <p><strong>Role:</strong> {user?.job}</p>
-        <p><strong>Admin:</strong> {user?.isAdmin ? "Yes" : "No"}</p>
-        <button className="ghost-button" onClick={logout}>Logout</button>
+        <p>
+          <strong>User Code:</strong> {user?.userCode}
+        </p>
+        <p>
+          <strong>Role:</strong> {user?.job}
+        </p>
+        <p>
+          <strong>Admin:</strong> {user?.isAdmin ? "Yes" : "No"}
+        </p>
+        <button className="ghost-button" onClick={logout}>
+          Logout
+        </button>
       </div>
       <button
         className="run-button save-button"