From cd21697af35f0a815a41d125753117188ee52ebb Mon Sep 17 00:00:00 2001
From: jtricerolph <info@tricerolph.com>
Date: Wed, 1 Jul 2026 14:59:51 +0000
Subject: [PATCH] Admins implicitly see all active apps (fixes empty portal for
 admin)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 src/routes/auth.js | 25 +++++++++++++++++--------
 1 file changed, 17 insertions(+), 8 deletions(-)

diff --git a/src/routes/auth.js b/src/routes/auth.js
index a8cd665..50d96cd 100644
--- a/src/routes/auth.js
+++ b/src/routes/auth.js
@@ -28,14 +28,23 @@ async function getUserWithApps(userId) {
   )
   if (!user) return null
 
-  const { rows: apps } = await pool.query(
-    `SELECT a.slug, a.name, a.description, a.base_path, a.icon, a.theme_color
-     FROM apps a
-     JOIN user_app_perms p ON p.app_id = a.id
-     WHERE p.user_id = $1 AND a.active = true
-     ORDER BY a.name`,
-    [userId]
-  )
+  // Admins implicitly have access to every active app; everyone else sees
+  // only the apps explicitly granted to them via user_app_perms.
+  const { rows: apps } = user.is_admin
+    ? await pool.query(
+        `SELECT a.slug, a.name, a.description, a.base_path, a.icon, a.theme_color
+         FROM apps a
+         WHERE a.active = true
+         ORDER BY a.name`
+      )
+    : await pool.query(
+        `SELECT a.slug, a.name, a.description, a.base_path, a.icon, a.theme_color
+         FROM apps a
+         JOIN user_app_perms p ON p.app_id = a.id
+         WHERE p.user_id = $1 AND a.active = true
+         ORDER BY a.name`,
+        [userId]
+      )
 
   return { ...user, apps }
 }