Skip to content

Designers can click team members through to a Team-Lead-only 403 #263

@ChesterSchendel

Description

@ChesterSchendel

Problem

On /dashboard/team, member rows link to /dashboard/team/members/[userId] for all viewers. A Team Member (designer, org:member) who clicks a teammate lands on a "Team Lead access required" 403. Members shouldn't be clickable for that role at all. Found 2026-05-29 designer-invite test.

Root cause

src/app/dashboard/team/page.tsx MemberRow: drillHref was set whenever member.userId existed, regardless of the viewer's role.

Fix (in PR #261)

Gate drillHref on the viewer's isAdmin (Team Lead) flag, which MemberRow already receives — designers get plain, non-clickable rows (and no drill-in arrow).

Future option

A limited read-only "Designer view" of member detail could be offered later; scope TBD. For now, non-clickable is the correct, safe behavior.

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions