feat(admin): backoffice access control (isAdmin role) by LucasCharrier · Pull Request #3187 · SocialGouv/egapro

LucasCharrier · 2026-04-08T13:57:02Z

Summary

Add users.isAdmin column (migration 0023_add_user_is_admin.sql).
Sync the flag from a new ADMIN_EMAILS env var in the NextAuth jwt callback (bidirectional: promotes and demotes on login).
New adminProcedure in tRPC, edge middleware + layout guard on /admin/* (redirects non-admin to /mon-espace), placeholder AdminHomePage.

Closes #3178

Quality gates

Typecheck / Tests (1071 passing) / Lint / Format
Structural / RGAA / Security audit

Follow-ups (not blocking)

`isAdmin` is cached in the 30-day JWT — a DB revocation only takes effect at next login.
ProConnect `email_verified` claim is not checked before admin promotion.
No audit log on admin promotion/demotion.

Generated with Claude Code

Adds an is_admin boolean flag on app_user to support the backoffice access control (issue #3178).

Introduce a server-side ADMIN_EMAILS env var (comma-separated). On each login, the NextAuth jwt callback syncs app_user.is_admin with that list (promotion and demotion), and propagates the flag into the JWT and session. Refactor the dbUser block to remove non-null assertions.

Restricts procedures to users with session.user.isAdmin === true and throws FORBIDDEN otherwise.

Edge middleware checks the JWT isAdmin flag on /admin/*. The admin layout re-checks the session on the Node runtime (defense in depth) and redirects non-admin users to /mon-espace. A minimal AdminHomePage is rendered for admin users.

revu-bot

Admin Access Control — Review Summary

The PR implements a solid, defense-in-depth admin access control system: DB column + env-var promotion, JWT caching, edge middleware, layout guard, tRPC procedure, and tests. The overall architecture is sound. A few issues need attention before merging.

File	Lines	Severity	Issue
`src/server/auth/config.ts`	216–238	CRITICAL	Admin flag synced only on login — new users get `isAdmin: false` in JWT even if in `ADMIN_EMAILS`
`src/middleware.ts`	26–28	CRITICAL	Unauthenticated non-admin redirected to `/mon-espace` instead of `/login`
`src/server/auth/config.ts`	36–42	IMPORTANT	`getAdminEmails()` re-parses env var on every login — should be memoized
`src/e2e/admin.e2e.ts`	1–9	IMPORTANT	E2E test doesn't set up an authenticated session — will always hit the unauthenticated redirect path
`src/app/admin/page.tsx`	11–13	MINOR	Unauthenticated user redirected to `/mon-espace` instead of `/login`

- middleware: treat a missing token.isAdmin as 'old token' and force re-login so the flag gets populated (otherwise existing users with a pre-PR JWT would be bounced to /mon-espace for up to 30 days). - auth/config: memoize the ADMIN_EMAILS set at module load instead of reparsing the env var on every sign-in. - admin/page: split the defense-in-depth check to redirect to /login when there is no session (avoids a redirect chain).

Adds unit tests for src/middleware.ts (4 cases: no token, missing isAdmin, non-admin, admin) and src/app/admin/page.tsx (4 cases: no session, non-admin, admin, fallback to email when name is null) to lift coverage on the new code.

The DB column was redundant: ADMIN_EMAILS is already the sole source of truth, re-evaluated on every sign-in. Remove the migration, the schema column, and the DB sync in the jwt callback. token.isAdmin is now computed directly from the memoized env var set. Promotion/demotion still takes effect at next login (same as before) but with zero persistent state to manage.

…edback - Extract the ADMIN_EMAILS parsing into a pure parseAdminEmails helper with 9 unit tests (edge cases: null/undefined, empty, whitespace, casing, trailing commas, dedup). Addresses maxgfr's review. - Remove the redundant defense-in-depth check in app/admin/page.tsx: the edge middleware + layout already guard the route. Addresses Viczei's review. - Wire ADMIN_EMAILS via a new optional 'admin' configmap on dev and preprod environments with test@fia1.fr preset, so QA and the E2E auth.setup user get backoffice access on non-prod. Prod has no configmap and must set ADMIN_EMAILS explicitly. Addresses Viczei's review.

Viczei · 2026-04-09T14:44:16Z

+		 * Comma-separated list of emails that should be granted the admin role
+		 * on login. The flag is then persisted in the `app_user.is_admin` column.
+		 */
+		ADMIN_EMAILS: z.string().optional().default(""),


je pense pas que l'on devrait laisser cette valeur en optional. Il vaut mieux que l'on ait toujours au moins un compte admin

Address Viczei's review: ADMIN_EMAILS should never be empty — there must always be at least one admin account. Changed from optional with empty default to z.string().min(1). Added prod SealedSecret and wired both configMapRef + secretRef in values.yaml.

The E2E workflow runs the app without SKIP_ENV_VALIDATION, so it needs the now-required ADMIN_EMAILS variable.

The CI test user is in ADMIN_EMAILS, so the test now verifies that an admin can access /admin and sees the backoffice page. The non-admin redirect path is covered by unit tests.

tokenbureau · 2026-04-13T07:34:16Z

🎉 Deployment for commit 19bfe27 :

Ingresses

🚀 https://egapro-feat-issue-3178-admin-role-5ksdr997.ovh.fabrique.social.gouv.fr/

Docker images

📦 docker pull harbor.fabrique.social.gouv.fr/egapro/egapro/app:sha-19bfe27d48fc246a19a5e991e4d5dec1741f98a1

Debug

- middleware: treat a missing token.isAdmin as 'old token' and force re-login so the flag gets populated (otherwise existing users with a pre-PR JWT would be bounced to /mon-espace for up to 30 days). - auth/config: memoize the ADMIN_EMAILS set at module load instead of reparsing the env var on every sign-in. - admin/page: split the defense-in-depth check to redirect to /login when there is no session (avoids a redirect chain).

LucasCharrier added 5 commits April 8, 2026 15:55

feat(db): add is_admin column on user table

80a3b1f

Adds an is_admin boolean flag on app_user to support the backoffice access control (issue #3178).

feat(trpc): add adminProcedure

7bfbace

Restricts procedures to users with session.user.isAdmin === true and throws FORBIDDEN otherwise.

test(admin): add e2e for non-admin redirect from /admin

83c63f0

LucasCharrier requested a review from a team as a code owner April 8, 2026 13:57

revu-bot Bot requested a review from revu-bot April 8, 2026 13:57

revu-bot reviewed Apr 8, 2026

View reviewed changes

Comment thread packages/app/src/middleware.ts

revu-bot reviewed Apr 8, 2026

View reviewed changes

Comment thread packages/app/src/server/auth/config.ts Outdated

revu-bot reviewed Apr 8, 2026

View reviewed changes

Comment thread packages/app/src/e2e/admin.e2e.ts

revu-bot reviewed Apr 8, 2026

View reviewed changes

Comment thread packages/app/src/app/admin/page.tsx Outdated

LucasCharrier had a problem deploying to review-auto April 8, 2026 13:58 — with GitHub Actions Error

LucasCharrier temporarily deployed to build-review-auto April 8, 2026 14:03 — with GitHub Actions Inactive

LucasCharrier had a problem deploying to review-auto April 8, 2026 14:06 — with GitHub Actions Error

test(admin): cover middleware and admin page

2009683

Adds unit tests for src/middleware.ts (4 cases: no token, missing isAdmin, non-admin, admin) and src/app/admin/page.tsx (4 cases: no session, non-admin, admin, fallback to email when name is null) to lift coverage on the new code.

LucasCharrier temporarily deployed to build-review-auto April 8, 2026 14:08 — with GitHub Actions Inactive

LucasCharrier temporarily deployed to review-auto April 8, 2026 14:12 — with GitHub Actions Inactive

LucasCharrier requested review from Viczei and maxgfr April 8, 2026 14:24

Viczei reviewed Apr 8, 2026

View reviewed changes

Comment thread packages/app/src/server/auth/config.ts Outdated

Viczei reviewed Apr 8, 2026

View reviewed changes

Comment thread packages/app/drizzle/0023_add_user_is_admin.sql Outdated

maxgfr reviewed Apr 8, 2026

View reviewed changes

Comment thread packages/app/src/app/admin/page.tsx Outdated

Comment thread packages/app/src/middleware.ts

Comment thread packages/app/src/server/auth/config.ts Outdated

LucasCharrier temporarily deployed to build-review-auto April 8, 2026 15:27 — with GitHub Actions Inactive

LucasCharrier temporarily deployed to review-auto April 8, 2026 15:30 — with GitHub Actions Inactive

LucasCharrier requested a review from a team as a code owner April 8, 2026 15:33

LucasCharrier temporarily deployed to build-review-auto April 8, 2026 15:34 — with GitHub Actions Inactive

LucasCharrier temporarily deployed to review-auto April 8, 2026 15:37 — with GitHub Actions Inactive

LucasCharrier mentioned this pull request Apr 8, 2026

feat(admin): mimoquage (impersonation) d'une entreprise #3188

Merged

2 tasks

LucasCharrier requested review from Viczei and maxgfr April 8, 2026 16:08

LucasCharrier mentioned this pull request Apr 9, 2026

feat(admin): add sidemenu navigation to backoffice #3195

Merged

2 tasks

Viczei reviewed Apr 9, 2026

View reviewed changes

Viczei approved these changes Apr 9, 2026

View reviewed changes

LucasCharrier temporarily deployed to build-review-auto April 9, 2026 15:58 — with GitHub Actions Inactive

LucasCharrier temporarily deployed to review-auto April 9, 2026 16:01 — with GitHub Actions Inactive

Merge branch 'alpha' into feat/issue-3178-admin-role

107da37

LucasCharrier temporarily deployed to build-review-auto April 9, 2026 16:09 — with GitHub Actions Inactive

LucasCharrier had a problem deploying to review-auto April 9, 2026 16:11 — with GitHub Actions Error

fix(ci): add ADMIN_EMAILS to E2E workflow env

3f0fd2f

The E2E workflow runs the app without SKIP_ENV_VALIDATION, so it needs the now-required ADMIN_EMAILS variable.

LucasCharrier temporarily deployed to build-review-auto April 9, 2026 16:12 — with GitHub Actions Inactive

LucasCharrier temporarily deployed to review-auto April 9, 2026 16:13 — with GitHub Actions Inactive

LucasCharrier enabled auto-merge (squash) April 9, 2026 16:13

fix(e2e): update admin test for admin user (test@fia1.fr is now admin)

35e8cab

The CI test user is in ADMIN_EMAILS, so the test now verifies that an admin can access /admin and sees the backoffice page. The non-admin redirect path is covered by unit tests.

LucasCharrier temporarily deployed to build-review-auto April 9, 2026 16:44 — with GitHub Actions Inactive

LucasCharrier temporarily deployed to review-auto April 9, 2026 16:47 — with GitHub Actions Inactive

merge: resolve conflicts with alpha (admin + audit cleanup)

19bfe27

LucasCharrier temporarily deployed to build-review-auto April 13, 2026 07:28 — with GitHub Actions Inactive

LucasCharrier temporarily deployed to review-auto April 13, 2026 07:31 — with GitHub Actions Inactive

LucasCharrier merged commit b5f362a into alpha Apr 13, 2026
15 checks passed

LucasCharrier deleted the feat/issue-3178-admin-role branch April 13, 2026 07:35

maxgfr removed their request for review April 13, 2026 12:59

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(admin): backoffice access control (isAdmin role)#3187

feat(admin): backoffice access control (isAdmin role)#3187
LucasCharrier merged 14 commits intoalphafrom
feat/issue-3178-admin-role

LucasCharrier commented Apr 8, 2026

Uh oh!

revu-bot left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Viczei Apr 9, 2026

Uh oh!

tokenbureau Bot commented Apr 13, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

LucasCharrier commented Apr 8, 2026

Summary

Quality gates

Follow-ups (not blocking)

Uh oh!

revu-bot left a comment

Choose a reason for hiding this comment

Admin Access Control — Review Summary

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Viczei Apr 9, 2026

Choose a reason for hiding this comment

Uh oh!

tokenbureau Bot commented Apr 13, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants