feat(frontend): wire router meta.minRole into a real guard, ranked against the backend's role order (#16244)

[mrveiss]

Single-issue rationale: #16244 covers wiring the router's meta.minRole into a real navigation guard, ranked by the backend's role order. No other open issue shares that scope. The nearest neighbour, #16243, is about usePermissions' permission-string vocabulary, which is a different file and a different mechanism.

Thinking Path

types/router.d.ts declared meta.minRole ("Minimum role required"), but nothing used it: no route set it, no guard read it. The only real role gate was meta.admin + userStore.isAdmin, so minRole looked like working access control but wasn't (found while fixing #14937, which retyped this field to the canonical Role).

Wired it in rather than removing it, per the issue's own ask: a route guard comparing the user's role to minRole by rank, sourced from the backend's actual ranking (autobot_shared/auth/permissions.py::_ROLE_META) rather than a second hand-written order.

This is UI routing only. Same as the existing meta.admin check it sits beside: it never grants access the backend refuses, and the backend's own permission gates remain the actual authority. It changes no route today — nothing sets minRole yet — it just makes the mechanism real so a route safely can.

What Changed

• constants/roles.ts: ROLE_RANK (mirrors _ROLE_META's priority order exactly: superadmin 110, admin 100, operator 80, analyst 60, editor 55, user 50, readonly 10) and meetsMinRole(role, minRole).
• router/index.ts: new exported pure function resolveMinRoleRedirect(to, userRole) — the strictest (highest-ranked) minRole among a route's matched records, checked against the caller's role, returning a redirect or null. Wired into the existing navigation guard right after the admin check, same style (redirect to /home, same debug-log pattern). Kept as a standalone function specifically so it's unit-testable without mocking the whole router/user-store stack (there was no existing router test file to extend).

Verification

• New tests: constants/__tests__/roles.test.ts (+6: rank ordering including the superadmin-above-admin case, meetsMinRole above/at/below the floor, fails safe on missing/unknown role) and a new router/__tests__/resolveMinRoleRedirect.test.ts (6 cases: below minRole redirects, at/above minRole allowed, no minRole set allows any authenticated user, no role at all redirects, strictest minRole among nested matched records wins).
• Pre-push hook: vue-tsc/vitest skipped locally (no node_modules) — CI is authoritative for frontend type-checking and tests.
• Pre-commit hooks (hardcoded-values, secret detection, frontend canonical checks) all passed.

Closes #16244

Model Used

Claude Sonnet 5

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 6612bdb9-64e9-4931-b789-206cd0fbd14c

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ SSOT Configuration Compliance: Passing

🎉 No new hardcoded values of either class — ssot and other both block.

Known backlog in pipeline-scripts/hardcoded_values_baseline.txt is suppressed and tracked in #14371.

[github-actions]

Notice: 29 open PRs — past the runaway threshold (25)

There is no PR queue limit, and this is not a request to defer this PR. Work proceeds one issue at a time without a cap on open PRs; review capacity is the constraint.

This notice only means the count is high enough to be worth a glance for a runaway — something opening PRs in a loop, or a merge pipeline that has stalled so nothing is draining.

Currently open:

• fix(frontend): converge the permission vocabulary onto the backend's real Permission enum, wire in v-permission (#16243) #16493 fix(frontend): converge the permission vocabulary onto the backend's real Permission enum, wire in v-permission (tech-debt(frontend): usePermissions' permission strings share nothing with the backend's Permission vocabulary #16243)
• security(research): treat fetched repos and pages as untrusted data (#16488) #16492 security(research): treat fetched repos and pages as untrusted data (security(research): treat fetched repos and pages as untrusted data: prompt-injection hardening for research, adopt and web-fetch #16488)
• chore(git): rename Dev_new_gui to main and main to release across the repo (#16479) #16487 chore(git): rename Dev_new_gui to main and main to release across the repo (infra(git): swap branch names across the repo for the rename (in-repo half of #16461) #16479)
• feat(secrets): wire in SecretAuditLog, consolidate SecretVault into SecretsManager (#16485) #16486 feat(secrets): wire in SecretAuditLog, consolidate SecretVault into SecretsManager (wire in SecretAuditLog, consolidate SecretVault into SecretsManager #16485)
• fix(frontend): retire four dead settings API paths, stop a fifth calling admin-gated settings from non-admin surfaces (#16481) #16484 fix(frontend): retire four dead settings API paths, stop a fifth calling admin-gated settings from non-admin surfaces (retire useSettingsApi/SystemRepository/services-api.ts/CacheService.ts dead settings paths #16481)
• feat(llm): cross-worker quota headroom store, persist real 429 headroom #16483 feat(llm): cross-worker quota headroom store, persist real 429 headroom
• chore(activity-tracking): retire the terminal/file/browser tracking hooks as dead code (#16466) #16475 chore(activity-tracking): retire the terminal/file/browser tracking hooks as dead code (chore(activity-tracking): wire in or retire terminal/file/browser activity tracking + secret_usage audit (backend) #16466)
• chore(deps): bump the npm_and_yarn group across 4 directories with 2 updates #16474 chore(deps): bump the npm_and_yarn group across 4 directories with 2 updates
• feat(collaboration): surface pending invitations in the collaboration panel (#16470) #16472 feat(collaboration): surface pending invitations in the collaboration panel (impl gap: surface pending collaboration invitations in a UI #16470)
• feat(collaboration): persist activity/notification history, add invitation list+respond endpoints (#16460) #16471 feat(collaboration): persist activity/notification history, add invitation list+respond endpoints (feat(collaboration): persist activity/notification history and add invitation list+respond endpoints #16460)
• security(settings): record the real caller on /sync and /hardware-priority, and test the anonymous and cross-org refusals (#16278) #16469 security(settings): record the real caller on /sync and /hardware-priority, and test the anonymous and cross-org refusals (security(settings): the core /api/settings routes read and write system config with no authentication #16278)
• fix(migrations): port 6 orphaned tables into the canonical Alembic chain (#16464) #16467 fix(migrations): port 6 orphaned tables into the canonical Alembic chain (fix(migrations): 6 tables in the orphaned database/migrations/ chain were never applied to the live Alembic chain #16464)
• feat(collaboration): wire the collaboration UI onto the real backend (#16443) #16462 feat(collaboration): wire the collaboration UI onto the real backend (impl gap: wire in the real-time collaborative-session UI (#608 phases 5-7 / #874) — 6 components + useSessionCollaboration, zero callers #16443)
• feat(mcp): admin-configured external MCP server bridge #16458 feat(mcp): admin-configured external MCP server bridge
• security(collaboration): authenticate and authorize the session-presence WebSocket (#16455) #16456 security(collaboration): authenticate and authorize the session-presence WebSocket (security(collaboration): WS /ws/sessions/{id}/presence trusts an unauthenticated client-supplied user_id #16455)
• fix(mcp): rename autobot-backend/mcp/ off the name it shadows (#16449) #16454 fix(mcp): rename autobot-backend/mcp/ off the name it shadows (chore(mcp): autobot-backend/mcp/ shadows the real mcp PyPI SDK, making it unreachable by name #16449)
• feat(secrets): wire in SecretAuditLog, consolidate SecretVault into SecretsManager (#16429) #16453 feat(secrets): wire in SecretAuditLog, consolidate SecretVault into SecretsManager (frontend(secrets): SecretVault, ShareSecretDialog and SecretAuditLog components are unwired #16429)
• docs(adr): supersede ADR-001's fixed VM count with role-separation placement (#15194) #16452 docs(adr): supersede ADR-001's fixed VM count with role-separation placement (docs: a fixed 6-VM topology is documented as the architecture — AutoBot scales from one VM or Docker to whatever is needed, and ADR-001 enshrines the wrong invariant #15194)
• fix(tooling): scope protect-files.sh's secrets/ rule to real credential storage (#16446) #16448 fix(tooling): scope protect-files.sh's secrets/ rule to real credential storage (fix(tooling): protect-files.sh's secrets/ rule blocks legitimate frontend source, zero real targets #16446)
• docs: describe role-based placement instead of a fixed VM count (#15194) #16445 docs: describe role-based placement instead of a fixed VM count (docs: a fixed 6-VM topology is documented as the architecture — AutoBot scales from one VM or Docker to whatever is needed, and ADR-001 enshrines the wrong invariant #15194)
• feat(secrets): bridge connector credential templates to ConnectorCredentialStore (#16428) #16444 feat(secrets): bridge connector credential templates to ConnectorCredentialStore (secrets: connector credential templates must write where knowledge connectors read #16428)
• security(secrets): admin-gate infrastructure hosts, fix vault-backed template names (#16426, #16427) #16442 security(secrets): admin-gate infrastructure hosts, fix vault-backed template names (security(secrets): any logged-in user can list and delete infrastructure hosts through /api/infrastructure/hosts #16426, bug(secrets): the OpenAI and Anthropic quick-add templates save names the vault mirror never recognizes, so the key never reaches the runtime #16427)
• refactor(slm): derive the role list's names, units, health and ports from the role manifests (#16025) #16441 refactor(slm): derive the role list's names, units, health and ports from the role manifests (SLM role shape has two sources of truth: role_registry.DEFAULT_ROLES vs autobot-infrastructure/*/manifest.yml #16025)
• fix(infra): map detect-environment.sh onto files that exist, and drop CONFIGURATION_GUIDE.md's dead env vars (#15143, #15151) #16440 fix(infra): map detect-environment.sh onto files that exist, and drop CONFIGURATION_GUIDE.md's dead env vars (bug(scripts): detect-environment.sh selects three .env files that do not exist #15143, bug(config): AUTOBOT_PLAYWRIGHT_HOST and AUTOBOT_PLAYWRIGHT_API_PORT are documented but read by nothing #15151)
• fix(frontend): point artifact-cells/CodeCell.vue at the shared --codecell-syntax-* tokens (#14853) #16437 fix(frontend): point artifact-cells/CodeCell.vue at the shared --codecell-syntax-* tokens (style(frontend): the two CodeCells now tokenise their syntax palette differently #14853)
• fix(knowledge): wire real grounding:stats counters, replacing the hardcoded claim_sources split (#14981) #16434 fix(knowledge): wire real grounding:stats counters, replacing the hardcoded claim_sources split (bug(knowledge): kb-stats reports a hardcoded claim_sources split — 65/22/13 on an empty KB with zero claims extracted #14981)
• security(auth): fail closed when the password-epoch check cannot reach Redis (#16411) #16433 security(auth): fail closed when the password-epoch check cannot reach Redis (security(backend-auth): password-epoch revocation check fails open when Redis errors (backend equivalent of #16387) #16411)
• chore(slm-frontend): retire getApiUrl(), route its display-only callers through getSlmApiBase() (#15761) #16432 chore(slm-frontend): retire getApiUrl(), route its display-only callers through getSlmApiBase() (tech-debt(slm-frontend): getApiUrl() survived the #13140 migration and still diverges from getSlmApiBase() in DEV #15761)
• chore(frontend): retire useApi.ts, the deprecated useApiWithState composable family (#15025) #16424 chore(frontend): retire useApi.ts, the deprecated useApiWithState composable family (tech-debt(frontend): useApi.ts still exports the deprecated useApiWithState with zero importers — the #7600 migration stopped short of the shim #15025)

If the queue is draining normally, ignore this. Otherwise:

1. Check whether CI is dispatching at all — see the ci-dispatch-watchdog status on these PRs
2. Merge the ones whose CI has finished and review has passed: gh pr merge <number> --squash --delete-branch
3. Look for a loop opening near-identical PRs

Warn-only runaway detector — .github/workflows/pr-queue-gate.yml. It never blocks a merge.

[mrveiss]

Independent review: approved. resolveMinRoleRedirect() is wired into beforeEach after the admin check. ROLE_RANK in constants/roles.ts matches autobot_shared/auth/permissions.py's _ROLE_META byte for byte (superadmin 110, admin 100, operator 80, analyst 60, editor 55, user 50, readonly 10). It's a client-side redirect only, so no backend gate is touched, and no route sets meta.minRole yet, so live routing doesn't change. There are no new UI strings. Closing refs are [16244], fully delivered, and required CI passes. It doesn't overlap #16493, so either can land first. Non-blocking: ROLE_RANK is mirrored by hand, and codegen is tracked in #16491.