fix unauthorised access to pages

[torkashvand]

No description provided.

[DutchBen]

I think this LGTM. At first I couldn't think of any use cases but this could be useful if someone with access rights shares a link with someone who doesn't. Currently the situation for the receiving user would be unclear, they would see the page but not the data. A review by @ricardovdheijden would be useful since he did most of the auth work

[torkashvand]

I think this LGTM. At first I couldn't think of any use cases but this could be useful if someone with access rights shares a link with someone who doesn't. Currently the situation for the receiving user would be unclear, they would see the page but not the data. A review by @ricardovdheijden would be useful since he did most of the auth work

I wanted to clarify that both the backend and frontend handle authorization separately. If a tab or menu is hidden from a user, they shouldn’t be able to access that page by typing in the URL.

In my case, I used OPA (Open Policy Agent) to hide certain menus, which worked. But I could still access the hidden pages by navigating to them manually, which shouldn't happen.

This is not about backend authorization; it’s important that the frontend also blocks these pages to prevent unauthorized access.

[DutchBen]

I wanted to clarify that both the backend and frontend handle authorization separately. If a tab or menu is hidden from a user, they shouldn’t be able to access that page by typing in the URL.

In my case, I used OPA (Open Policy Agent) to hide certain menus, which worked. But I could still access the hidden pages by navigating to them manually, which shouldn't happen.

This is not about backend authorization; it’s important that the frontend also blocks these pages to prevent unauthorized access.

To clarify the clarification. I understand the purpose of the PR and you are right and it aligns with my comment. The backend handles it's own authorization, you are able to call the api endpoints even without a frontend. That means the page becomes meaningless when you try to visit a page without rights because you will see different data and it's better to notify a user about that.