From b873df218dc7159175e27ba7feec6b4ec807c94b Mon Sep 17 00:00:00 2001
From: Jaideep Verma Mirchandani
 <18165084+jmirchandani@users.noreply.github.com>
Date: Thu, 10 Sep 2026 10:18:44 -0400
Subject: [PATCH 1/2] fix(admin): restrict admin-only routes to administrators

The user menu showed a Settings link to every role, and admin-only
routes mounted for anyone who typed their URL. The sidebar and command
palette already hide these entries below Admin, but that is navigation,
not a guard: a non-admin could still open the /settings hub and its
site-level pages, /users, /import/wordpress and a plugin's settings
page, where requests the server rejects left screens that failed to
load or could not save.

Add a RequireAdmin route guard, using the same in-component pattern the
byline schema page already uses, around those routes, and show the user
menu's Settings link only to admins. /settings/security stays open to
every role because it manages the signed-in user's own passkeys.

Editors lose read access to General, Social Links and SEO, which the
server allows at settings:read, and non-admins lose the language
switcher on the Settings hub. Both are deliberate and described in the
changeset.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AznEK6RvKGboBkFg4XqadT
---
 .changeset/settings-admin-gate.md             |  11 +
 packages/admin/src/components/Header.tsx      |  27 +-
 .../admin/src/components/RequireAdmin.tsx     |  47 ++++
 packages/admin/src/router.tsx                 | 135 ++++++++--
 .../admin/tests/components/Header.test.tsx    |  46 +++-
 .../tests/components/RequireAdmin.test.tsx    |  91 +++++++
 .../admin/tests/router-admin-gate.test.tsx    | 242 ++++++++++++++++++
 7 files changed, 571 insertions(+), 28 deletions(-)
 create mode 100644 .changeset/settings-admin-gate.md
 create mode 100644 packages/admin/src/components/RequireAdmin.tsx
 create mode 100644 packages/admin/tests/components/RequireAdmin.test.tsx
 create mode 100644 packages/admin/tests/router-admin-gate.test.tsx

diff --git a/.changeset/settings-admin-gate.md b/.changeset/settings-admin-gate.md
new file mode 100644
index 0000000000..9f4b64c28d
--- /dev/null
+++ b/.changeset/settings-admin-gate.md
@@ -0,0 +1,11 @@
+---
+"@emdash-cms/admin": patch
+---
+
+Fixes non-admin users being able to open admin-only screens in the admin UI. The **Settings** link in the user menu is now shown only to administrators, and a non-admin who opens a site-level settings page, **Users**, **WordPress import**, or a plugin's settings page by its URL now sees an "Access denied" message instead of a screen that fails to load or cannot save.
+
+#### Changes for Editors
+
+Editors could previously open **Settings → General**, **Social Links**, and **SEO** and read their values, although saving them already required an administrator. They can no longer open these pages. The **Settings** screen is also where the admin language is chosen, so Editors and other non-admins now choose the admin language on the sign-in screen.
+
+**Security** settings, where each user manages their own passkeys, remain available to every role from the user menu.
diff --git a/packages/admin/src/components/Header.tsx b/packages/admin/src/components/Header.tsx
index e60cb1fe5c..13efd70611 100644
--- a/packages/admin/src/components/Header.tsx
+++ b/packages/admin/src/components/Header.tsx
@@ -11,6 +11,9 @@ import { ThemeToggle } from "./ThemeToggle";
 
 export type { CurrentUser } from "../lib/api/current-user";
 
+// Role levels (matching @emdash-cms/auth)
+const ROLE_ADMIN = 50;
+
 async function handleLogout() {
 	// Clear the public-site toolbar-bootstrap flag (see Shell.tsx).
 	try {
@@ -39,6 +42,12 @@ export function Header() {
 
 	const { data: user } = useCurrentUser();
 
+	// Site settings are admin-only (the sidebar gates `/settings` on
+	// `ROLE_ADMIN` and the route itself is wrapped in `RequireAdmin`).
+	// Security settings stay visible to everyone: that page manages the
+	// signed-in user's own passkeys.
+	const canManageSettings = (user?.role ?? 0) >= ROLE_ADMIN;
+
 	// Get display name and initials
 	const displayName = user?.name || user?.email || t`User`;
 	const initialsSource = user?.name || user?.email || "U";
@@ -92,14 +101,16 @@ export function Header() {
 								<Shield className="h-4 w-4" />
 								{t`Security Settings`}
 							</Link>
-							<Link
-								to="/settings"
-								onClick={() => setUserMenuOpen(false)}
-								className="flex items-center gap-2 rounded-md px-3 py-2 text-sm hover:bg-kumo-tint"
-							>
-								<Gear className="h-4 w-4" />
-								{t`Settings`}
-							</Link>
+							{canManageSettings && (
+								<Link
+									to="/settings"
+									onClick={() => setUserMenuOpen(false)}
+									className="flex items-center gap-2 rounded-md px-3 py-2 text-sm hover:bg-kumo-tint"
+								>
+									<Gear className="h-4 w-4" />
+									{t`Settings`}
+								</Link>
+							)}
 							<hr className="my-1" />
 							<button
 								onClick={handleLogout}
diff --git a/packages/admin/src/components/RequireAdmin.tsx b/packages/admin/src/components/RequireAdmin.tsx
new file mode 100644
index 0000000000..0708e64ace
--- /dev/null
+++ b/packages/admin/src/components/RequireAdmin.tsx
@@ -0,0 +1,47 @@
+/**
+ * Admin-only route guard.
+ *
+ * The sidebar and command palette already hide admin entries via
+ * `minRole: ROLE_ADMIN`, but a manually-typed URL still mounts the route
+ * component — so the in-component check is the source of truth. This
+ * mirrors the gate inside `routes/byline-schema.tsx`: show a loader while
+ * the current user is being fetched, then either render the children or
+ * an access-denied surface instead of silently fetching and 403ing.
+ */
+
+import { Loader } from "@cloudflare/kumo";
+import { useLingui } from "@lingui/react/macro";
+import * as React from "react";
+
+import { useCurrentUser } from "../lib/api/current-user.js";
+
+// Mirror of `packages/auth/src/rbac.ts:Role.ADMIN`. Inline here for the
+// same reason the existing routes inline `ROLE_EDITOR` / `ROLE_ADMIN`:
+// avoids a circular dep through `@emdash-cms/auth` for the admin SPA.
+const ROLE_ADMIN = 50;
+
+export function RequireAdmin({ children }: { children: React.ReactNode }) {
+	const { t } = useLingui();
+	const { data: currentUser, isLoading: userLoading } = useCurrentUser();
+
+	if (userLoading) {
+		return (
+			<div className="flex items-center justify-center min-h-[50vh]">
+				<Loader />
+			</div>
+		);
+	}
+
+	if (!currentUser || currentUser.role < ROLE_ADMIN) {
+		return (
+			<div className="flex items-center justify-center min-h-[50vh]">
+				<div className="text-center">
+					<h1 className="text-2xl font-semibold leading-tight">{t`Access denied`}</h1>
+					<p className="mt-2 text-sm text-kumo-subtle">{t`You need admin permissions to view this page.`}</p>
+				</div>
+			</div>
+		);
+	}
+
+	return <>{children}</>;
+}
diff --git a/packages/admin/src/router.tsx b/packages/admin/src/router.tsx
index 83dd79a5cb..9261c5c9dc 100644
--- a/packages/admin/src/router.tsx
+++ b/packages/admin/src/router.tsx
@@ -53,6 +53,7 @@ import { PluginSettings } from "./components/PluginSettings";
 import { Redirects } from "./components/Redirects";
 import { RegistryBrowse } from "./components/RegistryBrowse";
 import { RegistryPluginDetail } from "./components/RegistryPluginDetail";
+import { RequireAdmin } from "./components/RequireAdmin";
 import { SandboxedPluginPage } from "./components/SandboxedPluginPage";
 import { SectionEditor } from "./components/SectionEditor";
 import { Sections } from "./components/Sections";
@@ -2064,11 +2065,21 @@ function CommentsPage() {
 	);
 }
 
-// Settings route
+// Settings routes. The sidebar and command palette hide `/settings` below
+// `ROLE_ADMIN`, but a manually-typed URL still mounts these components, so
+// every site-level settings page is wrapped in `RequireAdmin` (the same
+// in-component gate `BylineSchemaPage` uses). Two routes are deliberately
+// left unwrapped: `/settings/security` manages the signed-in user's *own*
+// passkeys and must stay reachable for every role, and
+// `/settings/media-usage` carries its own in-component admin gate.
 const settingsRoute = createRoute({
 	getParentRoute: () => adminLayoutRoute,
 	path: "/settings",
-	component: Settings,
+	component: () => (
+		<RequireAdmin>
+			<Settings />
+		</RequireAdmin>
+	),
 });
 
 const mediaUsageSettingsRoute = createRoute({
@@ -2077,7 +2088,7 @@ const mediaUsageSettingsRoute = createRoute({
 	component: MediaUsageSettings,
 });
 
-// Security settings route
+// Security settings route (per-user passkeys — intentionally not admin-gated)
 const securitySettingsRoute = createRoute({
 	getParentRoute: () => adminLayoutRoute,
 	path: "/settings/security",
@@ -2088,52 +2099,86 @@ const securitySettingsRoute = createRoute({
 const allowedDomainsSettingsRoute = createRoute({
 	getParentRoute: () => adminLayoutRoute,
 	path: "/settings/allowed-domains",
-	component: AllowedDomainsSettings,
+	component: () => (
+		<RequireAdmin>
+			<AllowedDomainsSettings />
+		</RequireAdmin>
+	),
 });
 
 // API tokens settings route
 const apiTokenSettingsRoute = createRoute({
 	getParentRoute: () => adminLayoutRoute,
 	path: "/settings/api-tokens",
-	component: ApiTokenSettings,
+	component: () => (
+		<RequireAdmin>
+			<ApiTokenSettings />
+		</RequireAdmin>
+	),
 });
 
 // Email settings route
 const emailSettingsRoute = createRoute({
 	getParentRoute: () => adminLayoutRoute,
 	path: "/settings/email",
-	component: EmailSettings,
+	component: () => (
+		<RequireAdmin>
+			<EmailSettings />
+		</RequireAdmin>
+	),
 });
 
 // Backup settings route
 const backupSettingsRoute = createRoute({
 	getParentRoute: () => adminLayoutRoute,
 	path: "/settings/backups",
-	component: BackupSettings,
+	component: () => (
+		<RequireAdmin>
+			<BackupSettings />
+		</RequireAdmin>
+	),
 });
 
 // General settings route
 const generalSettingsRoute = createRoute({
 	getParentRoute: () => adminLayoutRoute,
 	path: "/settings/general",
-	component: GeneralSettings,
+	component: () => (
+		<RequireAdmin>
+			<GeneralSettings />
+		</RequireAdmin>
+	),
 });
 
 // Social settings route
 const socialSettingsRoute = createRoute({
 	getParentRoute: () => adminLayoutRoute,
 	path: "/settings/social",
-	component: SocialSettings,
+	component: () => (
+		<RequireAdmin>
+			<SocialSettings />
+		</RequireAdmin>
+	),
 });
 
 // SEO settings route
 const seoSettingsRoute = createRoute({
 	getParentRoute: () => adminLayoutRoute,
 	path: "/settings/seo",
-	component: SeoSettings,
+	component: () => (
+		<RequireAdmin>
+			<SeoSettings />
+		</RequireAdmin>
+	),
 });
 
-// Plugin manager route
+// Plugin manager route. Nav-hidden below `ROLE_ADMIN`, but NOT wrapped in
+// `RequireAdmin`: the server enforces `plugins:read` (`Role.EDITOR`, see
+// `packages/auth/src/rbac.ts`) for the manifest/plugin list this page
+// reads, so an admin-only client gate would block a manually-typed URL
+// that the server itself allows. Mutations (install/enable/disable/
+// uninstall) are separately enforced server-side at `plugins:manage`
+// (`Role.ADMIN`).
 const pluginManagerRoute = createRoute({
 	getParentRoute: () => adminLayoutRoute,
 	path: "/plugins-manager",
@@ -2148,7 +2193,11 @@ function PluginManagerPage() {
 	return <PluginManager manifest={manifest} />;
 }
 
-// Marketplace browse route
+// Marketplace browse route. Nav-hidden below `ROLE_ADMIN` but deliberately
+// NOT wrapped in `RequireAdmin` — same reasoning as `pluginManagerRoute`
+// above: the server enforces `plugins:read` (`Role.EDITOR`) for browse and
+// detail reads, and `plugins:manage` (`Role.ADMIN`) only for the install
+// mutation.
 const marketplaceBrowseRoute = createRoute({
 	getParentRoute: () => adminLayoutRoute,
 	path: "/plugins/marketplace",
@@ -2239,7 +2288,11 @@ function MarketplaceDetailPage() {
 	return <MarketplacePluginDetail pluginId={pluginId} installedPluginIds={installedIds} />;
 }
 
-// Theme marketplace browse route
+// Theme marketplace browse route. Nav-hidden below `ROLE_ADMIN` but
+// deliberately NOT wrapped in `RequireAdmin`: every server endpoint under
+// `/_emdash/api/admin/themes/marketplace` (browse, detail, thumbnail) is
+// GET-only and enforces `plugins:read` (`Role.EDITOR`) — there is no
+// theme-marketplace mutation endpoint to gate at a higher tier.
 const themeMarketplaceBrowseRoute = createRoute({
 	getParentRoute: () => adminLayoutRoute,
 	path: "/themes/marketplace",
@@ -2258,11 +2311,19 @@ function ThemeDetailPage() {
 	return <ThemeMarketplaceDetail themeId={themeId} />;
 }
 
-// WordPress import route
+// WordPress import route. Nav-hidden below `ROLE_ADMIN` and wrapped in
+// `RequireAdmin`: every server handler under `/_emdash/api/import/wordpress`
+// (analyze, prepare, execute) enforces `import:execute` (`Role.ADMIN`) with
+// no lower-tier read path, so unlike the plugin/theme/content-type routes
+// above there is no EDITOR-tier functionality this guard would block.
 const wordpressImportRoute = createRoute({
 	getParentRoute: () => adminLayoutRoute,
 	path: "/import/wordpress",
-	component: WordPressImport,
+	component: () => (
+		<RequireAdmin>
+			<WordPressImport />
+		</RequireAdmin>
+	),
 });
 
 // Menu routes
@@ -2321,11 +2382,19 @@ const sectionEditRoute = createRoute({
 	component: SectionEditor,
 });
 
-// Users route
+// Users route. Nav-hidden below `ROLE_ADMIN` and wrapped in `RequireAdmin`:
+// `packages/core/src/astro/routes/api/admin/users/index.ts` explicitly
+// checks `user.role < Role.ADMIN` on GET (`users:read` is `Role.ADMIN` in
+// `packages/auth/src/rbac.ts`), so there is no EDITOR-tier read this guard
+// would block.
 const usersRoute = createRoute({
 	getParentRoute: () => adminLayoutRoute,
 	path: "/users",
-	component: UsersPage,
+	component: () => (
+		<RequireAdmin>
+			<UsersPage />
+		</RequireAdmin>
+	),
 });
 
 // Bylines route
@@ -2359,7 +2428,19 @@ const bylineSchemaRoute = createRoute({
 	component: BylineSchemaPage,
 });
 
-// Content Types routes
+// Content Types routes. Nav-hidden below `ROLE_ADMIN` but deliberately NOT
+// wrapped in `RequireAdmin` — the collections list/detail reads are
+// `schema:read` (`Role.EDITOR`); only the create/update/delete mutations are
+// `schema:manage` (`Role.ADMIN`). See
+// `packages/core/src/astro/routes/api/schema/collections/index.ts` and
+// `.../collections/[slug]/index.ts`.
+//
+// Note: `ContentTypesListPage` also unconditionally queries
+// `fetchOrphanedTables` (GET `/_emdash/api/schema/orphans`), which is gated
+// at `schema:manage` and treated as a fatal `ErrorScreen` on failure — so an
+// Editor loading this page already hits a full-page error today, wrap or no
+// wrap. That's a pre-existing bug, tracked separately, and not addressed by
+// this change.
 const contentTypesListRoute = createRoute({
 	getParentRoute: () => adminLayoutRoute,
 	path: "/content-types",
@@ -2589,10 +2670,26 @@ function ContentTypesEditPage() {
 // Auto-generated plugin settings route (from admin.settingsSchema).
 // Lives under /plugins-manager so it can never shadow a plugin's own
 // admin pages (which own the /plugins/$pluginId/* namespace).
+//
+// Wrapped in `RequireAdmin`: BOTH halves of the settings resource are
+// `plugins:manage` (`Role.ADMIN`) — the GET and the PUT of
+// `/_emdash/api/admin/plugins/[id]/settings` (see
+// `packages/core/src/astro/routes/api/admin/plugins/[id]/settings.ts:35,61`).
+// Unlike `/plugins-manager` itself, nothing on this page is readable at
+// `plugins:read`: the one Editor-tier read it makes (`fetchPlugin`) only
+// supplies the plugin's display name as chrome around that admin-only form,
+// and the plugin detail it returns stays reachable for Editors on
+// `/plugins-manager`. So the guard removes no access the RBAC model grants —
+// it replaces a 403-driven error surface with the same Access-denied screen
+// the other admin routes show.
 const pluginSettingsRoute = createRoute({
 	getParentRoute: () => adminLayoutRoute,
 	path: "/plugins-manager/$pluginId/settings",
-	component: PluginSettingsPage,
+	component: () => (
+		<RequireAdmin>
+			<PluginSettingsPage />
+		</RequireAdmin>
+	),
 });
 
 function PluginSettingsPage() {
diff --git a/packages/admin/tests/components/Header.test.tsx b/packages/admin/tests/components/Header.test.tsx
index 7ecdb9e637..bdaa3d043f 100644
--- a/packages/admin/tests/components/Header.test.tsx
+++ b/packages/admin/tests/components/Header.test.tsx
@@ -20,6 +20,9 @@ vi.mock("@tanstack/react-router", async () => {
 	};
 });
 
+// Mutable so individual tests can render the header as a non-admin.
+const currentUser = vi.hoisted(() => ({ role: 50 }));
+
 // Mock API
 vi.mock("../../src/lib/api/client", async () => {
 	const actual = await vi.importActual("../../src/lib/api/client");
@@ -34,7 +37,7 @@ vi.mock("../../src/lib/api/client", async () => {
 								id: "1",
 								name: "Matt Kane",
 								email: "matt@test.com",
-								role: 50,
+								role: currentUser.role,
 							},
 						}),
 						{ status: 200 },
@@ -54,6 +57,11 @@ const { Header } = await import("../../src/components/Header");
 // ---------------------------------------------------------------------------
 
 const THEME_BUTTON_REGEX = /Toggle theme/;
+const USER_MENU_REGEX = /Matt Kane/;
+
+// Mirror @emdash-cms/auth Role levels (kept inline, matching Header.tsx).
+const ROLE_AUTHOR = 30;
+const ROLE_ADMIN = 50;
 
 function TestWrapper({ children }: { children: React.ReactNode }) {
 	const qc = new QueryClient({
@@ -72,6 +80,7 @@ describe("Header", () => {
 	beforeEach(() => {
 		localStorage.clear();
 		document.documentElement.removeAttribute("data-mode");
+		currentUser.role = ROLE_ADMIN;
 	});
 
 	it("theme toggle button is present", async () => {
@@ -104,4 +113,39 @@ describe("Header", () => {
 		);
 		await expect.element(screen.getByText("View Site")).toBeInTheDocument();
 	});
+
+	describe("user menu role gate", () => {
+		it("shows Settings and Security Settings for an admin", async () => {
+			const screen = await render(
+				<TestWrapper>
+					<Header />
+				</TestWrapper>,
+			);
+			await screen.getByRole("button", { name: USER_MENU_REGEX }).click();
+
+			await expect
+				.element(screen.getByRole("link", { name: "Settings", exact: true }))
+				.toBeInTheDocument();
+			await expect
+				.element(screen.getByRole("link", { name: "Security Settings", exact: true }))
+				.toBeInTheDocument();
+		});
+
+		it("hides Settings for a non-admin but keeps Security Settings (own passkeys)", async () => {
+			currentUser.role = ROLE_AUTHOR;
+			const screen = await render(
+				<TestWrapper>
+					<Header />
+				</TestWrapper>,
+			);
+			await screen.getByRole("button", { name: USER_MENU_REGEX }).click();
+
+			await expect
+				.element(screen.getByRole("link", { name: "Security Settings", exact: true }))
+				.toBeInTheDocument();
+			await expect
+				.element(screen.getByRole("link", { name: "Settings", exact: true }))
+				.not.toBeInTheDocument();
+		});
+	});
 });
diff --git a/packages/admin/tests/components/RequireAdmin.test.tsx b/packages/admin/tests/components/RequireAdmin.test.tsx
new file mode 100644
index 0000000000..4db0e3e03a
--- /dev/null
+++ b/packages/admin/tests/components/RequireAdmin.test.tsx
@@ -0,0 +1,91 @@
+/**
+ * `RequireAdmin` — the in-component gate wrapped around the admin-only
+ * `/settings*` routes in `router.tsx`. The sidebar hides those entries for
+ * non-admins, but a manually-typed URL still mounts the route component,
+ * so this guard is the source of truth for URL-direct navigation.
+ */
+
+import * as React from "react";
+import { describe, it, expect, vi, beforeEach } from "vitest";
+
+import { render } from "../utils/render.tsx";
+
+// Mirror @emdash-cms/auth Role levels (kept inline, matching RequireAdmin.tsx).
+const ROLE_AUTHOR = 30;
+const ROLE_EDITOR = 40;
+const ROLE_ADMIN = 50;
+
+const currentUser = vi.hoisted(() => ({
+	role: 50 as number,
+	isLoading: false,
+	signedIn: true,
+}));
+
+vi.mock("../../src/lib/api/current-user.js", () => ({
+	useCurrentUser: () => ({
+		data: currentUser.signedIn
+			? { id: "user-1", email: "user@example.com", role: currentUser.role }
+			: undefined,
+		isLoading: currentUser.isLoading,
+	}),
+}));
+
+// Import after mocks
+const { RequireAdmin } = await import("../../src/components/RequireAdmin");
+
+const CHILD_TEXT = "Protected settings content";
+
+describe("RequireAdmin", () => {
+	beforeEach(() => {
+		currentUser.role = ROLE_ADMIN;
+		currentUser.isLoading = false;
+		currentUser.signedIn = true;
+	});
+
+	it("renders its children for an admin", async () => {
+		const screen = await render(
+			<RequireAdmin>
+				<p>{CHILD_TEXT}</p>
+			</RequireAdmin>,
+		);
+		await expect.element(screen.getByText(CHILD_TEXT)).toBeInTheDocument();
+		await expect.element(screen.getByText("Access denied")).not.toBeInTheDocument();
+	});
+
+	it.each([
+		["editor", ROLE_EDITOR],
+		["author", ROLE_AUTHOR],
+	])("shows Access denied instead of its children for an %s", async (_label, role) => {
+		currentUser.role = role;
+		const screen = await render(
+			<RequireAdmin>
+				<p>{CHILD_TEXT}</p>
+			</RequireAdmin>,
+		);
+		await expect.element(screen.getByText("Access denied")).toBeInTheDocument();
+		await expect.element(screen.getByText(CHILD_TEXT)).not.toBeInTheDocument();
+	});
+
+	it("treats a missing user as denied", async () => {
+		currentUser.signedIn = false;
+		const screen = await render(
+			<RequireAdmin>
+				<p>{CHILD_TEXT}</p>
+			</RequireAdmin>,
+		);
+		await expect.element(screen.getByText("Access denied")).toBeInTheDocument();
+		await expect.element(screen.getByText(CHILD_TEXT)).not.toBeInTheDocument();
+	});
+
+	it("renders neither children nor the denial while the user is loading", async () => {
+		currentUser.isLoading = true;
+		currentUser.signedIn = false;
+		const screen = await render(
+			<RequireAdmin>
+				<p>{CHILD_TEXT}</p>
+			</RequireAdmin>,
+		);
+		await expect.element(screen.getByText(CHILD_TEXT)).not.toBeInTheDocument();
+		await expect.element(screen.getByText("Access denied")).not.toBeInTheDocument();
+	});
+});
diff --git a/packages/admin/tests/router-admin-gate.test.tsx b/packages/admin/tests/router-admin-gate.test.tsx
new file mode 100644
index 0000000000..3f7971735c
--- /dev/null
+++ b/packages/admin/tests/router-admin-gate.test.tsx
@@ -0,0 +1,242 @@
+/**
+ * Regression coverage for the route groups audited alongside the
+ * `/settings` admin gate (card emdb-023). All of them are nav-hidden below
+ * `ROLE_ADMIN` in `router.tsx`, but the server's own RBAC tiers
+ * (`packages/auth/src/rbac.ts`) differ per route, so only some of them
+ * belong behind the `RequireAdmin` guard:
+ *
+ * - `/settings` and its 7 sub-pages, `/users`, and `/import/wordpress`:
+ *   every server read is `Role.ADMIN` (`users:read`, `import:execute`, or
+ *   the settings endpoints), so these ARE wrapped in `RequireAdmin` —
+ *   verified below by rendering all 11 routes.
+ * - `/plugins-manager/$pluginId/settings`: both the GET and the PUT of the
+ *   plugin settings resource are `plugins:manage` (`Role.ADMIN`), and the
+ *   page's only Editor-tier read (`fetchPlugin`) is display chrome that
+ *   stays reachable on `/plugins-manager` — so this one IS wrapped too.
+ * - `/content-types`, `/plugins-manager`, `/plugins/marketplace`, and
+ *   `/themes/marketplace`: the server enforces only `Role.EDITOR` for reads
+ *   (`schema:read` / `plugins:read`), so wrapping them in `RequireAdmin`
+ *   would regress Editor access the RBAC model deliberately grants. These
+ *   four are covered by `UNWRAPPED_ROUTES` below, which mounts each one
+ *   through the router as an Editor and asserts the page still renders.
+ *   That negative space is the point: their own component tests
+ *   (`PluginManager.test.tsx`, `MarketplacePluginDetail.test.tsx`, …) mount
+ *   the components directly, never through the router with a role-mocked
+ *   user, so nothing there would catch an accidental `RequireAdmin` wrap —
+ *   it would ship silently. This file is the only place that can.
+ */
+
+import { Toasty } from "@cloudflare/kumo";
+import { i18n } from "@lingui/core";
+import { I18nProvider } from "@lingui/react";
+import { QueryClientProvider } from "@tanstack/react-query";
+import { RouterProvider } from "@tanstack/react-router";
+import * as React from "react";
+import { describe, it, expect, vi, afterEach } from "vitest";
+
+import type { AdminManifest } from "../src/lib/api";
+import { createAdminRouter } from "../src/router";
+import { render } from "./utils/render.tsx";
+import { createTestQueryClient, createMockFetch } from "./utils/test-helpers";
+
+vi.mock("../src/components/Shell", () => ({
+	Shell: ({ children }: { children: React.ReactNode }) => <div data-testid="shell">{children}</div>,
+}));
+
+vi.mock("../src/components/AdminCommandPalette", () => ({
+	AdminCommandPalette: () => null,
+}));
+
+vi.mock("../src/routes/users", () => ({
+	UsersPage: () => <div>Users page content</div>,
+}));
+
+vi.mock("../src/components/WordPressImport", () => ({
+	WordPressImport: () => <div>WordPress import content</div>,
+}));
+
+vi.mock("../src/components/PluginSettings", () => ({
+	PluginSettings: () => <div>Plugin settings content</div>,
+}));
+
+// The four deliberately-unwrapped pages (see UNWRAPPED_ROUTES). Their route
+// components are thin wrappers in router.tsx that pass query data down, so
+// stubbing the leaf component is enough to give each route a marker.
+//
+// These spread `importOriginal` rather than replacing the module outright:
+// three of the four also export siblings that other modules import
+// (`moveCollection`, `MarketplaceInstallMessage`, `UninstallConfirmDialog`,
+// `AuditBadge`), and a bare factory drops them, breaking the import graph.
+vi.mock("../src/components/ContentTypeList", async (importOriginal) => ({
+	...(await importOriginal<typeof import("../src/components/ContentTypeList")>()),
+	ContentTypeList: () => <div>Content types content</div>,
+}));
+
+vi.mock("../src/components/PluginManager", async (importOriginal) => ({
+	...(await importOriginal<typeof import("../src/components/PluginManager")>()),
+	PluginManager: () => <div>Plugin manager content</div>,
+}));
+
+vi.mock("../src/components/MarketplaceBrowse", async (importOriginal) => ({
+	...(await importOriginal<typeof import("../src/components/MarketplaceBrowse")>()),
+	MarketplaceBrowse: () => <div>Marketplace browse content</div>,
+}));
+
+vi.mock("../src/components/ThemeMarketplaceBrowse", async (importOriginal) => ({
+	...(await importOriginal<typeof import("../src/components/ThemeMarketplaceBrowse")>()),
+	ThemeMarketplaceBrowse: () => <div>Theme marketplace content</div>,
+}));
+
+vi.mock("../src/components/Settings", () => ({
+	Settings: () => <div>Settings content</div>,
+}));
+
+vi.mock("../src/components/settings/AllowedDomainsSettings", () => ({
+	AllowedDomainsSettings: () => <div>Allowed domains content</div>,
+}));
+
+vi.mock("../src/components/settings/ApiTokenSettings", () => ({
+	ApiTokenSettings: () => <div>API tokens content</div>,
+}));
+
+vi.mock("../src/components/settings/BackupSettings", () => ({
+	BackupSettings: () => <div>Backups content</div>,
+}));
+
+vi.mock("../src/components/settings/EmailSettings", () => ({
+	EmailSettings: () => <div>Email settings content</div>,
+}));
+
+vi.mock("../src/components/settings/GeneralSettings", () => ({
+	GeneralSettings: () => <div>General settings content</div>,
+}));
+
+vi.mock("../src/components/settings/SeoSettings", () => ({
+	SeoSettings: () => <div>SEO settings content</div>,
+}));
+
+vi.mock("../src/components/settings/SocialSettings", () => ({
+	SocialSettings: () => <div>Social settings content</div>,
+}));
+
+const MANIFEST: AdminManifest = {
+	version: "1.0.0",
+	hash: "abc123",
+	authMode: "passkey",
+	collections: {},
+	plugins: {},
+	taxonomies: [],
+};
+
+function buildRouter() {
+	const queryClient = createTestQueryClient();
+	const router = createAdminRouter(queryClient);
+	if (!i18n.locale) {
+		i18n.loadAndActivate({ locale: "en", messages: {} });
+	}
+	function TestApp() {
+		return (
+			<I18nProvider i18n={i18n}>
+				<Toasty>
+					<QueryClientProvider client={queryClient}>
+						<RouterProvider router={router} />
+					</QueryClientProvider>
+				</Toasty>
+			</I18nProvider>
+		);
+	}
+	return { router, TestApp };
+}
+
+const WRAPPED_ROUTES: Array<[string, string]> = [
+	["/settings", "Settings content"],
+	["/settings/allowed-domains", "Allowed domains content"],
+	["/settings/api-tokens", "API tokens content"],
+	["/settings/email", "Email settings content"],
+	["/settings/backups", "Backups content"],
+	["/settings/general", "General settings content"],
+	["/settings/social", "Social settings content"],
+	["/settings/seo", "SEO settings content"],
+	["/users", "Users page content"],
+	["/import/wordpress", "WordPress import content"],
+	["/plugins-manager/test-plugin/settings", "Plugin settings content"],
+];
+
+/**
+ * The mirror image of WRAPPED_ROUTES: routes that must STAY reachable for a
+ * non-admin. Every read behind these is `Role.EDITOR` or below, so a
+ * `RequireAdmin` wrapper here would be a capability regression shipped as a
+ * security fix — the failure mode this table exists to catch.
+ */
+const UNWRAPPED_ROUTES: Array<[string, string]> = [
+	["/content-types", "Content types content"],
+	["/plugins-manager", "Plugin manager content"],
+	["/plugins/marketplace", "Marketplace browse content"],
+	["/themes/marketplace", "Theme marketplace content"],
+];
+
+describe("RequireAdmin-wrapped routes (emdb-023): /settings + 7 sub-pages, /users, /import/wordpress, plugin settings", () => {
+	let mockFetch: ReturnType<typeof createMockFetch>;
+
+	afterEach(() => {
+		mockFetch.restore();
+	});
+
+	it.each(WRAPPED_ROUTES)(
+		"shows Access denied instead of %s for a non-admin (Editor) user",
+		async (to, marker) => {
+			mockFetch = createMockFetch();
+			mockFetch
+				.on("GET", "/_emdash/api/manifest", { data: MANIFEST })
+				.on("GET", "/_emdash/api/auth/me", { data: { id: "user_01", role: 40 } });
+
+			const { router, TestApp } = buildRouter();
+			await router.navigate({ to });
+			const screen = await render(<TestApp />);
+
+			await expect.element(screen.getByText("Access denied")).toBeInTheDocument();
+			await expect.element(screen.getByText(marker)).not.toBeInTheDocument();
+		},
+	);
+
+	it.each(WRAPPED_ROUTES)("renders %s for an admin", async (to, marker) => {
+		mockFetch = createMockFetch();
+		mockFetch
+			.on("GET", "/_emdash/api/manifest", { data: MANIFEST })
+			.on("GET", "/_emdash/api/auth/me", { data: { id: "user_01", role: 50 } });
+
+		const { router, TestApp } = buildRouter();
+		await router.navigate({ to });
+		const screen = await render(<TestApp />);
+
+		await expect.element(screen.getByText(marker)).toBeInTheDocument();
+		await expect.element(screen.getByText("Access denied")).not.toBeInTheDocument();
+	});
+});
+
+describe("deliberately UNWRAPPED routes (emdb-023): still reachable for a non-admin", () => {
+	let mockFetch: ReturnType<typeof createMockFetch>;
+
+	afterEach(() => {
+		mockFetch.restore();
+	});
+
+	it.each(UNWRAPPED_ROUTES)("renders %s for a non-admin (Editor) user", async (to, marker) => {
+		mockFetch = createMockFetch();
+		mockFetch
+			.on("GET", "/_emdash/api/manifest", { data: MANIFEST })
+			.on("GET", "/_emdash/api/auth/me", { data: { id: "user_01", role: 40 } })
+			// `/content-types` treats a failed collections OR orphans query as a
+			// fatal ErrorScreen, which would mask the marker; both are Editor-
+			// readable in production (`schema:read`), so both resolve empty here.
+			.on("GET", "/_emdash/api/schema/collections", { data: { items: [] } })
+			.on("GET", "/_emdash/api/schema/orphans", { data: { items: [] } });
+
+		const { router, TestApp } = buildRouter();
+		await router.navigate({ to });
+		const screen = await render(<TestApp />);
+
+		await expect.element(screen.getByText(marker)).toBeInTheDocument();
+		await expect.element(screen.getByText("Access denied")).not.toBeInTheDocument();
+	});
+});

From f51e42b57cb1871f044f97f6ba51daa0ca8637f4 Mon Sep 17 00:00:00 2001
From: Jaideep Verma Mirchandani
 <18165084+jmirchandani@users.noreply.github.com>
Date: Thu, 10 Sep 2026 14:03:34 -0400
Subject: [PATCH 2/2] refactor(admin): trim comments per review

Trim review-narrative comments from the admin gate change down to
short factual ones per house style, and shorten two describe() titles
in router-admin-gate.test.tsx. No executable code changed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AznEK6RvKGboBkFg4XqadT
---
 packages/admin/src/components/Header.tsx      |  4 --
 .../admin/src/components/RequireAdmin.tsx     | 14 ----
 packages/admin/src/router.tsx                 | 68 +++----------------
 .../tests/components/RequireAdmin.test.tsx    |  7 --
 .../admin/tests/router-admin-gate.test.tsx    | 50 ++------------
 5 files changed, 14 insertions(+), 129 deletions(-)

diff --git a/packages/admin/src/components/Header.tsx b/packages/admin/src/components/Header.tsx
index 13efd70611..16344e4c18 100644
--- a/packages/admin/src/components/Header.tsx
+++ b/packages/admin/src/components/Header.tsx
@@ -42,10 +42,6 @@ export function Header() {
 
 	const { data: user } = useCurrentUser();
 
-	// Site settings are admin-only (the sidebar gates `/settings` on
-	// `ROLE_ADMIN` and the route itself is wrapped in `RequireAdmin`).
-	// Security settings stay visible to everyone: that page manages the
-	// signed-in user's own passkeys.
 	const canManageSettings = (user?.role ?? 0) >= ROLE_ADMIN;
 
 	// Get display name and initials
diff --git a/packages/admin/src/components/RequireAdmin.tsx b/packages/admin/src/components/RequireAdmin.tsx
index 0708e64ace..b6f3392072 100644
--- a/packages/admin/src/components/RequireAdmin.tsx
+++ b/packages/admin/src/components/RequireAdmin.tsx
@@ -1,23 +1,9 @@
-/**
- * Admin-only route guard.
- *
- * The sidebar and command palette already hide admin entries via
- * `minRole: ROLE_ADMIN`, but a manually-typed URL still mounts the route
- * component — so the in-component check is the source of truth. This
- * mirrors the gate inside `routes/byline-schema.tsx`: show a loader while
- * the current user is being fetched, then either render the children or
- * an access-denied surface instead of silently fetching and 403ing.
- */
-
 import { Loader } from "@cloudflare/kumo";
 import { useLingui } from "@lingui/react/macro";
 import * as React from "react";
 
 import { useCurrentUser } from "../lib/api/current-user.js";
 
-// Mirror of `packages/auth/src/rbac.ts:Role.ADMIN`. Inline here for the
-// same reason the existing routes inline `ROLE_EDITOR` / `ROLE_ADMIN`:
-// avoids a circular dep through `@emdash-cms/auth` for the admin SPA.
 const ROLE_ADMIN = 50;
 
 export function RequireAdmin({ children }: { children: React.ReactNode }) {
diff --git a/packages/admin/src/router.tsx b/packages/admin/src/router.tsx
index 9261c5c9dc..715b32d3c0 100644
--- a/packages/admin/src/router.tsx
+++ b/packages/admin/src/router.tsx
@@ -2065,13 +2065,7 @@ function CommentsPage() {
 	);
 }
 
-// Settings routes. The sidebar and command palette hide `/settings` below
-// `ROLE_ADMIN`, but a manually-typed URL still mounts these components, so
-// every site-level settings page is wrapped in `RequireAdmin` (the same
-// in-component gate `BylineSchemaPage` uses). Two routes are deliberately
-// left unwrapped: `/settings/security` manages the signed-in user's *own*
-// passkeys and must stay reachable for every role, and
-// `/settings/media-usage` carries its own in-component admin gate.
+// Settings route
 const settingsRoute = createRoute({
 	getParentRoute: () => adminLayoutRoute,
 	path: "/settings",
@@ -2088,7 +2082,7 @@ const mediaUsageSettingsRoute = createRoute({
 	component: MediaUsageSettings,
 });
 
-// Security settings route (per-user passkeys — intentionally not admin-gated)
+// Security settings route
 const securitySettingsRoute = createRoute({
 	getParentRoute: () => adminLayoutRoute,
 	path: "/settings/security",
@@ -2172,13 +2166,7 @@ const seoSettingsRoute = createRoute({
 	),
 });
 
-// Plugin manager route. Nav-hidden below `ROLE_ADMIN`, but NOT wrapped in
-// `RequireAdmin`: the server enforces `plugins:read` (`Role.EDITOR`, see
-// `packages/auth/src/rbac.ts`) for the manifest/plugin list this page
-// reads, so an admin-only client gate would block a manually-typed URL
-// that the server itself allows. Mutations (install/enable/disable/
-// uninstall) are separately enforced server-side at `plugins:manage`
-// (`Role.ADMIN`).
+// Plugin manager route
 const pluginManagerRoute = createRoute({
 	getParentRoute: () => adminLayoutRoute,
 	path: "/plugins-manager",
@@ -2193,11 +2181,7 @@ function PluginManagerPage() {
 	return <PluginManager manifest={manifest} />;
 }
 
-// Marketplace browse route. Nav-hidden below `ROLE_ADMIN` but deliberately
-// NOT wrapped in `RequireAdmin` — same reasoning as `pluginManagerRoute`
-// above: the server enforces `plugins:read` (`Role.EDITOR`) for browse and
-// detail reads, and `plugins:manage` (`Role.ADMIN`) only for the install
-// mutation.
+// Marketplace browse route
 const marketplaceBrowseRoute = createRoute({
 	getParentRoute: () => adminLayoutRoute,
 	path: "/plugins/marketplace",
@@ -2288,11 +2272,7 @@ function MarketplaceDetailPage() {
 	return <MarketplacePluginDetail pluginId={pluginId} installedPluginIds={installedIds} />;
 }
 
-// Theme marketplace browse route. Nav-hidden below `ROLE_ADMIN` but
-// deliberately NOT wrapped in `RequireAdmin`: every server endpoint under
-// `/_emdash/api/admin/themes/marketplace` (browse, detail, thumbnail) is
-// GET-only and enforces `plugins:read` (`Role.EDITOR`) — there is no
-// theme-marketplace mutation endpoint to gate at a higher tier.
+// Theme marketplace browse route
 const themeMarketplaceBrowseRoute = createRoute({
 	getParentRoute: () => adminLayoutRoute,
 	path: "/themes/marketplace",
@@ -2311,11 +2291,7 @@ function ThemeDetailPage() {
 	return <ThemeMarketplaceDetail themeId={themeId} />;
 }
 
-// WordPress import route. Nav-hidden below `ROLE_ADMIN` and wrapped in
-// `RequireAdmin`: every server handler under `/_emdash/api/import/wordpress`
-// (analyze, prepare, execute) enforces `import:execute` (`Role.ADMIN`) with
-// no lower-tier read path, so unlike the plugin/theme/content-type routes
-// above there is no EDITOR-tier functionality this guard would block.
+// WordPress import route
 const wordpressImportRoute = createRoute({
 	getParentRoute: () => adminLayoutRoute,
 	path: "/import/wordpress",
@@ -2382,11 +2358,7 @@ const sectionEditRoute = createRoute({
 	component: SectionEditor,
 });
 
-// Users route. Nav-hidden below `ROLE_ADMIN` and wrapped in `RequireAdmin`:
-// `packages/core/src/astro/routes/api/admin/users/index.ts` explicitly
-// checks `user.role < Role.ADMIN` on GET (`users:read` is `Role.ADMIN` in
-// `packages/auth/src/rbac.ts`), so there is no EDITOR-tier read this guard
-// would block.
+// Users route
 const usersRoute = createRoute({
 	getParentRoute: () => adminLayoutRoute,
 	path: "/users",
@@ -2428,19 +2400,7 @@ const bylineSchemaRoute = createRoute({
 	component: BylineSchemaPage,
 });
 
-// Content Types routes. Nav-hidden below `ROLE_ADMIN` but deliberately NOT
-// wrapped in `RequireAdmin` — the collections list/detail reads are
-// `schema:read` (`Role.EDITOR`); only the create/update/delete mutations are
-// `schema:manage` (`Role.ADMIN`). See
-// `packages/core/src/astro/routes/api/schema/collections/index.ts` and
-// `.../collections/[slug]/index.ts`.
-//
-// Note: `ContentTypesListPage` also unconditionally queries
-// `fetchOrphanedTables` (GET `/_emdash/api/schema/orphans`), which is gated
-// at `schema:manage` and treated as a fatal `ErrorScreen` on failure — so an
-// Editor loading this page already hits a full-page error today, wrap or no
-// wrap. That's a pre-existing bug, tracked separately, and not addressed by
-// this change.
+// Content Types routes
 const contentTypesListRoute = createRoute({
 	getParentRoute: () => adminLayoutRoute,
 	path: "/content-types",
@@ -2670,18 +2630,6 @@ function ContentTypesEditPage() {
 // Auto-generated plugin settings route (from admin.settingsSchema).
 // Lives under /plugins-manager so it can never shadow a plugin's own
 // admin pages (which own the /plugins/$pluginId/* namespace).
-//
-// Wrapped in `RequireAdmin`: BOTH halves of the settings resource are
-// `plugins:manage` (`Role.ADMIN`) — the GET and the PUT of
-// `/_emdash/api/admin/plugins/[id]/settings` (see
-// `packages/core/src/astro/routes/api/admin/plugins/[id]/settings.ts:35,61`).
-// Unlike `/plugins-manager` itself, nothing on this page is readable at
-// `plugins:read`: the one Editor-tier read it makes (`fetchPlugin`) only
-// supplies the plugin's display name as chrome around that admin-only form,
-// and the plugin detail it returns stays reachable for Editors on
-// `/plugins-manager`. So the guard removes no access the RBAC model grants —
-// it replaces a 403-driven error surface with the same Access-denied screen
-// the other admin routes show.
 const pluginSettingsRoute = createRoute({
 	getParentRoute: () => adminLayoutRoute,
 	path: "/plugins-manager/$pluginId/settings",
diff --git a/packages/admin/tests/components/RequireAdmin.test.tsx b/packages/admin/tests/components/RequireAdmin.test.tsx
index 4db0e3e03a..cb3b1987ba 100644
--- a/packages/admin/tests/components/RequireAdmin.test.tsx
+++ b/packages/admin/tests/components/RequireAdmin.test.tsx
@@ -1,10 +1,3 @@
-/**
- * `RequireAdmin` — the in-component gate wrapped around the admin-only
- * `/settings*` routes in `router.tsx`. The sidebar hides those entries for
- * non-admins, but a manually-typed URL still mounts the route component,
- * so this guard is the source of truth for URL-direct navigation.
- */
-
 import * as React from "react";
 import { describe, it, expect, vi, beforeEach } from "vitest";
 
diff --git a/packages/admin/tests/router-admin-gate.test.tsx b/packages/admin/tests/router-admin-gate.test.tsx
index 3f7971735c..86c41544dc 100644
--- a/packages/admin/tests/router-admin-gate.test.tsx
+++ b/packages/admin/tests/router-admin-gate.test.tsx
@@ -1,31 +1,3 @@
-/**
- * Regression coverage for the route groups audited alongside the
- * `/settings` admin gate (card emdb-023). All of them are nav-hidden below
- * `ROLE_ADMIN` in `router.tsx`, but the server's own RBAC tiers
- * (`packages/auth/src/rbac.ts`) differ per route, so only some of them
- * belong behind the `RequireAdmin` guard:
- *
- * - `/settings` and its 7 sub-pages, `/users`, and `/import/wordpress`:
- *   every server read is `Role.ADMIN` (`users:read`, `import:execute`, or
- *   the settings endpoints), so these ARE wrapped in `RequireAdmin` —
- *   verified below by rendering all 11 routes.
- * - `/plugins-manager/$pluginId/settings`: both the GET and the PUT of the
- *   plugin settings resource are `plugins:manage` (`Role.ADMIN`), and the
- *   page's only Editor-tier read (`fetchPlugin`) is display chrome that
- *   stays reachable on `/plugins-manager` — so this one IS wrapped too.
- * - `/content-types`, `/plugins-manager`, `/plugins/marketplace`, and
- *   `/themes/marketplace`: the server enforces only `Role.EDITOR` for reads
- *   (`schema:read` / `plugins:read`), so wrapping them in `RequireAdmin`
- *   would regress Editor access the RBAC model deliberately grants. These
- *   four are covered by `UNWRAPPED_ROUTES` below, which mounts each one
- *   through the router as an Editor and asserts the page still renders.
- *   That negative space is the point: their own component tests
- *   (`PluginManager.test.tsx`, `MarketplacePluginDetail.test.tsx`, …) mount
- *   the components directly, never through the router with a role-mocked
- *   user, so nothing there would catch an accidental `RequireAdmin` wrap —
- *   it would ship silently. This file is the only place that can.
- */
-
 import { Toasty } from "@cloudflare/kumo";
 import { i18n } from "@lingui/core";
 import { I18nProvider } from "@lingui/react";
@@ -59,14 +31,9 @@ vi.mock("../src/components/PluginSettings", () => ({
 	PluginSettings: () => <div>Plugin settings content</div>,
 }));
 
-// The four deliberately-unwrapped pages (see UNWRAPPED_ROUTES). Their route
-// components are thin wrappers in router.tsx that pass query data down, so
-// stubbing the leaf component is enough to give each route a marker.
-//
-// These spread `importOriginal` rather than replacing the module outright:
-// three of the four also export siblings that other modules import
-// (`moveCollection`, `MarketplaceInstallMessage`, `UninstallConfirmDialog`,
-// `AuditBadge`), and a bare factory drops them, breaking the import graph.
+// Spread `importOriginal` rather than replacing the module outright: three
+// of these four also export siblings that other modules import, and a bare
+// factory would drop them and break the import graph.
 vi.mock("../src/components/ContentTypeList", async (importOriginal) => ({
 	...(await importOriginal<typeof import("../src/components/ContentTypeList")>()),
 	ContentTypeList: () => <div>Content types content</div>,
@@ -162,12 +129,7 @@ const WRAPPED_ROUTES: Array<[string, string]> = [
 	["/plugins-manager/test-plugin/settings", "Plugin settings content"],
 ];
 
-/**
- * The mirror image of WRAPPED_ROUTES: routes that must STAY reachable for a
- * non-admin. Every read behind these is `Role.EDITOR` or below, so a
- * `RequireAdmin` wrapper here would be a capability regression shipped as a
- * security fix — the failure mode this table exists to catch.
- */
+// Routes that must stay reachable for a non-admin (Editor-tier reads).
 const UNWRAPPED_ROUTES: Array<[string, string]> = [
 	["/content-types", "Content types content"],
 	["/plugins-manager", "Plugin manager content"],
@@ -175,7 +137,7 @@ const UNWRAPPED_ROUTES: Array<[string, string]> = [
 	["/themes/marketplace", "Theme marketplace content"],
 ];
 
-describe("RequireAdmin-wrapped routes (emdb-023): /settings + 7 sub-pages, /users, /import/wordpress, plugin settings", () => {
+describe("admin-only routes show Access denied to non-admins", () => {
 	let mockFetch: ReturnType<typeof createMockFetch>;
 
 	afterEach(() => {
@@ -214,7 +176,7 @@ describe("RequireAdmin-wrapped routes (emdb-023): /settings + 7 sub-pages, /user
 	});
 });
 
-describe("deliberately UNWRAPPED routes (emdb-023): still reachable for a non-admin", () => {
+describe("routes that stay reachable for non-admins", () => {
 	let mockFetch: ReturnType<typeof createMockFetch>;
 
 	afterEach(() => {