From 1ba9dda0ed8b97bac7896b5762585e0a4b971cd4 Mon Sep 17 00:00:00 2001
From: Phillip Thelen <phillip@habitica.com>
Date: Mon, 4 Aug 2025 14:21:36 +0200
Subject: [PATCH] add new permission for managing blockers

---
 website/client/src/components/admin/container.vue |  9 ++++++++-
 website/client/src/components/header/menu.vue     | 13 +++++++++++--
 website/client/src/router/index.js                |  5 +++--
 website/server/controllers/api-v4/admin.js        |  8 ++++----
 website/server/models/user/schema.js              |  1 +
 5 files changed, 27 insertions(+), 9 deletions(-)

diff --git a/website/client/src/components/admin/container.vue b/website/client/src/components/admin/container.vue
index 54337ff7c7..fd12a577b0 100644
--- a/website/client/src/components/admin/container.vue
+++ b/website/client/src/components/admin/container.vue
@@ -2,11 +2,14 @@
   <div class="row">
     <secondary-menu class="col-12">
       <router-link
+        v-if="user.permissions.fullAccess || user.permissions.userSupport"
         class="nav-link"
         :to="{name: 'adminPanel'}"
       >
         {{ $t('adminPanel') }}
-      </router-link><router-link
+      </router-link>
+      <router-link
+        v-if="user.permissions.fullAccess || user.permissions.accessControl"
         class="nav-link"
         :to="{name: 'blockers'}"
       >
@@ -19,11 +22,15 @@
 </template>
 
 <script>
+import { mapState } from '@/libs/store';
 import SecondaryMenu from '@/components/secondaryMenu';
 
 export default {
   components: {
     SecondaryMenu,
   },
+  computed: {
+    ...mapState({ user: 'user.data' }),
+  },
 };
 </script>
diff --git a/website/client/src/components/header/menu.vue b/website/client/src/components/header/menu.vue
index 599a7b62b1..f7224f90cd 100644
--- a/website/client/src/components/header/menu.vue
+++ b/website/client/src/components/header/menu.vue
@@ -329,8 +329,7 @@
             </div>
           </li>
           <li
-            v-if="user.permissions.fullAccess ||
-              user.permissions.userSupport"
+            v-if="hasElevatedPrivileges"
             class="topbar-item droppable"
             :class="{
               'active': $route.path.startsWith('/admin')}"
@@ -346,6 +345,7 @@
               ></div>
             </div>
             <router-link
+              v-if="user.permissions.fullAccess || user.permissions.userSupport"
               class="nav-link"
               :to="{name: 'adminPanel'}"
             >
@@ -353,18 +353,21 @@
             </router-link>
             <div class="topbar-dropdown">
               <router-link
+                v-if="user.permissions.fullAccess || user.permissions.userSupport"
                 class="topbar-dropdown-item dropdown-item"
                 :to="{name: 'adminPanel'}"
               >
                 {{ $t("adminPanel") }}
               </router-link>
               <router-link
+                v-if="user.permissions.fullAccess || user.permissions.accessControl"
                 class="topbar-dropdown-item dropdown-item"
                 :to="{name: 'blockers'}"
               >
                 {{ $t("siteBlockers") }}
               </router-link>
               <a
+                v-if="user.permissions.fullAccess || user.permissions.news"
                 class="topbar-dropdown-item dropdown-item"
                 target="_blank"
                 href="https://panel.habitica.com"
@@ -839,6 +842,12 @@ export default {
         params: { groupId: this.groupPlans[0]._id },
       };
     },
+    hasElevatedPrivileges () {
+      return this.user.permissions.fullAccess
+        || this.user.permissions.userSupport
+        || this.user.permissions.accessControl
+        || this.user.permissions.news;
+    },
   },
   async mounted () {
     await this.getUserGroupPlans();
diff --git a/website/client/src/router/index.js b/website/client/src/router/index.js
index 3763d9771a..cc82cd6cae 100644
--- a/website/client/src/router/index.js
+++ b/website/client/src/router/index.js
@@ -180,12 +180,13 @@ const router = new VueRouter({
     },
 
     {
-      name: 'adminPanel',
+      name: 'adminSection',
       path: '/admin',
       component: AdminContainerPage,
       meta: {
         privilegeNeeded: [ // any one of these is enough to give access
           'userSupport',
+          'accessControl',
         ],
       },
       children: [
@@ -227,7 +228,7 @@ const router = new VueRouter({
           component: BlockerPage,
           meta: {
             privilegeNeeded: [ // any one of these is enough to give access
-              'userSupport',
+              'accessControl',
             ],
           },
         },
diff --git a/website/server/controllers/api-v4/admin.js b/website/server/controllers/api-v4/admin.js
index c9b67fbec3..9dc7757ac1 100644
--- a/website/server/controllers/api-v4/admin.js
+++ b/website/server/controllers/api-v4/admin.js
@@ -122,7 +122,7 @@ api.getUserHistory = {
 api.getBlockers = {
   method: 'GET',
   url: '/admin/blockers',
-  middlewares: [authWithHeaders(), ensurePermission('userSupport')],
+  middlewares: [authWithHeaders(), ensurePermission('accessControl')],
   async handler (req, res) {
     const blockers = await Blocker
       .find({ disabled: false })
@@ -136,7 +136,7 @@ api.getBlockers = {
 api.createBlocker = {
   method: 'POST',
   url: '/admin/blockers',
-  middlewares: [authWithHeaders(), ensurePermission('userSupport')],
+  middlewares: [authWithHeaders(), ensurePermission('accessControl')],
   async handler (req, res) {
     const id = uuid();
     const blocker = await Blocker({
@@ -151,7 +151,7 @@ api.createBlocker = {
 api.updateBlocker = {
   method: 'PUT',
   url: '/admin/blockers/:blockerId',
-  middlewares: [authWithHeaders(), ensurePermission('userSupport')],
+  middlewares: [authWithHeaders(), ensurePermission('accessControl')],
   async handler (req, res) {
     req.checkParams('blockerId', res.t('blockerIdRequired')).notEmpty().isUUID();
 
@@ -171,7 +171,7 @@ api.updateBlocker = {
 api.deleteBlocker = {
   method: 'DELETE',
   url: '/admin/blockers/:blockerId',
-  middlewares: [authWithHeaders(), ensurePermission('userSupport')],
+  middlewares: [authWithHeaders(), ensurePermission('accessControl')],
   async handler (req, res) {
     req.checkParams('blockerId', res.t('blockerIdRequired')).notEmpty().isUUID();
 
diff --git a/website/server/models/user/schema.js b/website/server/models/user/schema.js
index 0277d66de8..477d522181 100644
--- a/website/server/models/user/schema.js
+++ b/website/server/models/user/schema.js
@@ -224,6 +224,7 @@ export const UserSchema = new Schema({
     userSupport: Boolean, // access User Support feature in Admin Panel
     challengeAdmin: Boolean, // Can manage and administrate challenges
     moderator: Boolean, // Can ban, flag users and manage social spaces
+    accessControl: Boolean, // Can manage IP and client blockers
     coupons: Boolean, // Can generate and request coupons
   },
   balance: { $type: Number, default: 0 },