Repository navigation
Allow staff to edit and delete blocklist entries - #71
Merged
Merged
Conversation
Staff could previously only add blocklist entries. They now have full create/edit/delete access, matching abuse reports. Adds inline editing to the blocklist manager for staff and admins, and prevents edits from overwriting who originally added an entry. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0194vp1Wt4B526Kes4zSsL4Q
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Staff could previously only add blocklist entries; editing and removing was admin-only. This gives staff full edit/delete access to any blocklist entry, including ones added by others.
server/entity-routes.js):BlocklistEntrymoves intoSTAFF_WRITABLE(same asAbuseReport). Regular users are still refused. PATCH requests now stripadded_byso editing an entry can't rewrite who originally added it.BlocklistManager.jsx): staff and admins get edit (pencil) and delete buttons on each entry. Editing is inline — value, record type, reason, notes and regex toggle, with save/cancel. There was previously no edit UI at all, even for admins.server/blocklist-permissions.test.js): replaced the "staff cannot edit or remove" test with tests that staff can edit/delete, regular users can't, andadded_bycan't be overwritten on edit.Protected brands were already staff-editable, so no change there.
Testing
node --test server/blocklist-permissions.test.jsandnpm run buildbefore merging.Generated by Claude Code