From eb93a32f4bdc713e02c465ede3d56759c5d1d417 Mon Sep 17 00:00:00 2001
From: splitsec2 <35583321+splitsec2@users.noreply.github.com>
Date: Tue, 3 Nov 2026 00:32:06 -0600
Subject: [PATCH] fix(ui): show Debug and Restart in the menu to admins only
 (#1653)

The Debug and Restart items in the menu show for every signed-in user
whenever Debug Mode is on, but `/api/debug` and `/api/restart` both need
an admin, so a regular user who clicks one gets a 403 page. The menu now
hides them unless the user is an admin.

It uses the auth check's `is_admin`, which is true when auth is off, so
a no-auth install keeps both items. The Debug chip in the footer is a
label and stays.

Frontend typecheck passes. I also ran a scratch instance with Debug Mode
on: the admin account sees Debug and Restart, a regular user sees only
Report a Bug and Settings, and with auth off both items are still there.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

<!-- coderabbit-ai-generated:v1 -->

## Summary by CodeRabbit

* **Bug Fixes**
* Debug information in the header is now shown only when debugging is
configured and the signed-in user is an administrator.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---
 src/frontend/src/App.tsx | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/frontend/src/App.tsx b/src/frontend/src/App.tsx
index 687546ec..859686a8 100644
--- a/src/frontend/src/App.tsx
+++ b/src/frontend/src/App.tsx
@@ -2459,7 +2459,7 @@ function App() {
         <Header
           calibreWebUrl={config?.calibre_web_url || ''}
           audiobookLibraryUrl={config?.audiobook_library_url || ''}
-          debug={config?.debug || false}
+          debug={(config?.debug || false) && authIsAdmin}
           logoUrl={logoUrl}
           showSearch={!isInitialState}
           searchInput={activeQueryValue}