From 1cdd944aca3f1a4ec82362f603ce93ec70813bfa Mon Sep 17 00:00:00 2001
From: Kroonk <Tom.misch2@gmail.com>
Date: Fri, 22 May 2026 00:04:56 +0200
Subject: [PATCH] fix: only render admin panel link for admins

---
 app.js     | 34 +++++++++++++++++++++++++++++-----
 index.html |  3 +--
 sw.js      |  4 ++--
 3 files changed, 32 insertions(+), 9 deletions(-)

diff --git a/app.js b/app.js
index 4a51565..4149b9f 100644
--- a/app.js
+++ b/app.js
@@ -33,10 +33,10 @@ const favoritesSections = document.querySelector('#favoritesSections');
 const loginButton = document.querySelector('#dashboardLoginButton');
 const logoutButton = document.querySelector('#dashboardLogoutButton');
 const favoritesLink = document.querySelector('#favoritesLink');
-const adminPanelLink = document.querySelector('#adminPanelLink');
 const userBadge = document.querySelector('#dashboardUserBadge');
 const dashboardMenuButton = document.querySelector('#dashboardMenuButton');
 const dashboardMenuPanel = document.querySelector('#dashboardMenuPanel');
+let adminPanelLink = null;
 
 function normalize(value) {
   return String(value || '').toLowerCase().trim();
@@ -510,16 +510,40 @@ function toggleDashboardMenu() {
   dashboardMenuPanel.hidden = isOpen;
 }
 
+function hasAdminAccess(claims) {
+  const username = String(claims?.preferred_username || '').toLowerCase();
+  const email = String(claims?.email || '').toLowerCase();
+  return username === 'mrdiderot' || email === 'mail.misch@pm.me';
+}
+
+function ensureAdminPanelLink() {
+  if (adminPanelLink || !dashboardMenuPanel) return adminPanelLink;
+
+  adminPanelLink = document.createElement('a');
+  adminPanelLink.className = 'dashboard-menu-item';
+  adminPanelLink.id = 'adminPanelLink';
+  adminPanelLink.href = '/admin.html';
+  adminPanelLink.textContent = 'Admin Panel';
+  adminPanelLink.hidden = true;
+
+  dashboardMenuPanel.insertBefore(adminPanelLink, favoritesLink || loginButton || null);
+  return adminPanelLink;
+}
+
 function updateAuthNav() {
   const authenticated = MischLabsAuth.isAuthenticated();
   const claims = MischLabsAuth.claims();
-  const username = String(claims?.preferred_username || '').toLowerCase();
-  const email = String(claims?.email || '').toLowerCase();
-  const isAdmin = authenticated && (username === 'mrdiderot' || email === 'mail.misch@pm.me');
+  const isAdmin = authenticated && hasAdminAccess(claims);
   if (loginButton) loginButton.hidden = authenticated;
   if (logoutButton) logoutButton.hidden = !authenticated;
   if (favoritesLink) favoritesLink.hidden = !authenticated;
-  if (adminPanelLink) adminPanelLink.hidden = !isAdmin;
+  if (isAdmin) {
+    const link = ensureAdminPanelLink();
+    if (link) link.hidden = false;
+  } else if (adminPanelLink) {
+    adminPanelLink.remove();
+    adminPanelLink = null;
+  }
   if (userBadge) {
     userBadge.hidden = !authenticated;
     userBadge.textContent = authenticated ? MischLabsAuth.displayName() : '';
diff --git a/index.html b/index.html
index 96672ef..2d2dea5 100644
--- a/index.html
+++ b/index.html
@@ -51,7 +51,6 @@
             </button>
             <nav class="dashboard-menu-panel" id="dashboardMenuPanel" aria-label="Dashboard Aktionen" hidden>
                 <span class="dashboard-menu-user" id="dashboardUserBadge" hidden></span>
-                <a class="dashboard-menu-item" id="adminPanelLink" href="/admin.html" hidden>Admin Panel</a>
                 <a class="dashboard-menu-item" id="favoritesLink" href="/favorites.html" hidden>Favoriten verwalten</a>
                 <button class="dashboard-menu-item" id="dashboardLoginButton" type="button">SSO Login</button>
                 <button class="dashboard-menu-item is-danger" id="dashboardLogoutButton" type="button" hidden>Abmelden</button>
@@ -142,6 +141,6 @@
     </div>
 
     <script src="/auth.js?v=2" defer></script>
-    <script src="/app.js?v=36" defer></script>
+    <script src="/app.js?v=37" defer></script>
 </body>
 </html>
diff --git a/sw.js b/sw.js
index efbae3d..76f8812 100644
--- a/sw.js
+++ b/sw.js
@@ -1,4 +1,4 @@
-const CACHE_NAME = 'mischlabs-pwa-v20';
+const CACHE_NAME = 'mischlabs-pwa-v21';
 const APP_SHELL = [
   '/',
   '/index.html',
@@ -6,7 +6,7 @@ const APP_SHELL = [
   '/offline.html',
   '/style.css?v=30',
   '/auth.js?v=2',
-  '/app.js?v=36',
+  '/app.js?v=37',
   '/favorites.js?v=1',
   '/services.json?v=1',
   '/manifest.webmanifest?v=4',