feat(webapp): put the whole admin dashboard behind the flag, renamed ADMIN_DASHBOARD_ENABLED

The requireSuper authorization branch now honors the flag, so every admin
dashboard page redirects away when disabled; the display-permission booleans
and useHasAdminAccess follow suit, hiding the admin nav affordances. The
hand-rolled admin.data-stores checks get the same gate.

Author: myftija

.server-changes/admin-dashboard-enabled-flag.md

@@ -0,0 +1,6 @@
+---
+area: webapp
+type: feature
+---
+
+The admin dashboard and user impersonation can now be disabled for an entire instance by setting `ADMIN_DASHBOARD_ENABLED=0`.

.server-changes/impersonation-enabled-flag.md

@@ -1,6 +1,6 @@
 # TEMP - DO NOT MERGE: preview-only override to demo the disabled state.
 # Revert this commit before merging.
 web_app:
-  IMPERSONATION_ENABLED: "0"
+  ADMIN_DASHBOARD_ENABLED: "0"
 api:
-  IMPERSONATION_ENABLED: "0"
+  ADMIN_DASHBOARD_ENABLED: "0"

.triggerdotdev/preview-env.yml

@@ -332,8 +332,8 @@ const EnvironmentSchema = z
       .refine(isValidRegex, "WHITELISTED_EMAILS must be a valid regex.")
       .optional(),
     ADMIN_EMAILS: z.string().refine(isValidRegex, "ADMIN_EMAILS must be a valid regex.").optional(),
-    // Instance-level kill switch for user impersonation.
-    IMPERSONATION_ENABLED: BoolEnv.default(true),
+    // Instance-level kill switch for the admin dashboard and user impersonation.
+    ADMIN_DASHBOARD_ENABLED: BoolEnv.default(true),
     REMIX_APP_PORT: z.string().optional(),
     // Opt-in, dev-only: stream this process's logs over a local telnet/TCP socket on this port.
     // Read directly from process.env in server.ts (before this schema loads); declared here for discoverability.

apps/webapp/app/env.server.ts

@@ -48,6 +48,12 @@ export function useHasAdminAccess(matches?: UIMatch[]): boolean {
   const user = useOptionalUser(matches);
   const isImpersonating = useIsImpersonating(matches);
   const isViewingAsUser = useIsViewingAsUser(matches);
+  const routeMatch = useTypedMatchesData<typeof loader>({
+    id: "root",
+    matches,
+  });
+
+  if (routeMatch?.adminDashboardEnabled === false) return false;
 
   return (Boolean(user?.admin) || isImpersonating) && !isViewingAsUser;
 }

apps/webapp/app/hooks/useUser.ts

@@ -18,8 +18,8 @@ const pageSize = 20;
 
 // 404, not 403, so a disabled instance doesn't advertise the feature.
 // Stopping an impersonation is deliberately never gated.
-export function requireImpersonationEnabled(): void {
-  if (!env.IMPERSONATION_ENABLED) {
+export function requireAdminDashboardEnabled(): void {
+  if (!env.ADMIN_DASHBOARD_ENABLED) {
     throw new Response("Not Found", { status: 404 });
   }
 }
@@ -226,7 +226,7 @@ export async function redirectWithImpersonation(
   currentUser?: { id: string; admin: boolean },
   prismaClient: PrismaClientOrTransaction = prisma
 ) {
-  requireImpersonationEnabled();
+  requireAdminDashboardEnabled();
 
   const user = currentUser ?? (await requireUser(request));
   if (!user.admin) {
@@ -343,7 +343,7 @@ export async function startImpersonation(
 
 export async function clearImpersonation(request: Request, path: string) {
   const authUser = await authenticator.isAuthenticated(request);
-  // Raw read: stops must audit and clear even with IMPERSONATION_ENABLED off.
+  // Raw read: stops must audit and clear even with ADMIN_DASHBOARD_ENABLED off.
   const targetId = await getRawImpersonationId(request);
 
   if (targetId && authUser?.userId) {

apps/webapp/app/models/admin.server.ts

@@ -120,7 +120,7 @@ export const loader = async ({ request }: LoaderFunctionArgs) => {
   // impersonating.
   // Flag off: terminate lingering impersonation sessions (audit + clear)
   // rather than leaving a cookie that would resurrect on a later re-enable.
-  if (!env.IMPERSONATION_ENABLED && (await getRawImpersonationId(request))) {
+  if (!env.ADMIN_DASHBOARD_ENABLED && (await getRawImpersonationId(request))) {
     const url = new URL(request.url);
     throw await clearImpersonation(request, `${url.pathname}${url.search}`);
   }
@@ -134,6 +134,7 @@ export const loader = async ({ request }: LoaderFunctionArgs) => {
     {
       user,
       isViewingAsUser,
+      adminDashboardEnabled: env.ADMIN_DASHBOARD_ENABLED,
       toastMessage,
       posthogProjectKey,
       posthogUiHost,

apps/webapp/app/root.tsx

@@ -3,7 +3,7 @@ import { z } from "zod";
 import { prisma } from "~/db.server";
 import { runStore } from "~/v3/runStore.server";
 import { controlPlaneResolver } from "~/v3/runOpsMigration/controlPlaneResolver.server";
-import { requireImpersonationEnabled } from "~/models/admin.server";
+import { requireAdminDashboardEnabled } from "~/models/admin.server";
 import { redirectWithErrorMessage } from "~/models/message.server";
 import { requireUser } from "~/services/session.server";
 import { impersonate, rootPath, v3RunPath, v3RunSpanPath } from "~/utils/pathBuilder";
@@ -14,7 +14,7 @@ const ParamsSchema = z.object({
 });
 
 export async function loader({ params, request }: LoaderFunctionArgs) {
-  requireImpersonationEnabled();
+  requireAdminDashboardEnabled();
 
   const user = await requireUser(request);
 

apps/webapp/app/routes/@.runs.$runParam.ts

@@ -10,7 +10,7 @@ import { env } from "~/env.server";
 import {
   clearImpersonation,
   findImpersonationTarget,
-  requireImpersonationEnabled,
+  requireAdminDashboardEnabled,
   startImpersonation,
 } from "~/models/admin.server";
 import { logger } from "~/services/logger.server";
@@ -27,7 +27,7 @@ import { isSameOriginNavigation } from "~/utils/sameOriginNavigation";
 // here would drag server-only modules into the client build.
 
 export async function loader({ request, params }: LoaderFunctionArgs) {
-  requireImpersonationEnabled();
+  requireAdminDashboardEnabled();
 
   const user = await requireUser(request);
 
@@ -104,7 +104,7 @@ function refererOrigin(request: Request): string | undefined {
 }
 
 export async function action({ request, params }: ActionFunctionArgs) {
-  requireImpersonationEnabled();
+  requireAdminDashboardEnabled();
 
   if (request.method.toLowerCase() !== "post") {
     return new Response("Method not allowed", { status: 405 });

apps/webapp/app/routes/_app.@.orgs.$organizationSlug.$.tsx

@@ -37,7 +37,7 @@ export const loader = dashboardLoader(
     }
     const result = await adminGetUsers(user.id, searchParams.params.getAll());
 
-    return typedjson({ ...result, impersonationEnabled: env.IMPERSONATION_ENABLED });
+    return typedjson({ ...result, impersonationEnabled: env.ADMIN_DASHBOARD_ENABLED });
   }
 );