Gate admin design system by inbox access

[evebouf]

Changes

• Restrict Design System Show the admin design-system navigation and resolve its route only for principals granted the existing inbox permission; direct unauthorized requests, including the trailing-slash form, return not found.
• Share Email Allowlist Reuse one case-insensitive INBOX_USERS matcher across the web inbox/calendar surfaces and the admin surface, including the existing all override.
• Verify Both States Cover allowlisted and denied routes, permission bootstrap, navigation behavior, case normalization, and inbox behavior; 230 admin tests and 29 focused web tests pass with both plugin typechecks, focused lint, formatting, and live UI QA.

Screenshots

• Allowlisted The existing Design system entry appears at the bottom of the admin navigation.

• Not Allowlisted The admin navigation ends at Crons and does not expose the Design system entry.

Risk assessment

• Stylistic frontend only: No The change alters route authorization, permission data flow, and navigation availability.
• Logic changes: Present Admin bootstrap now derives an inbox permission from INBOX_USERS, and both client routing and direct design-system routes enforce it.
• Security risk: Medium The change narrows access using an existing allowlist and adds denial coverage, but authorization behavior and environment configuration remain security-sensitive.
• Risk level: High · Safe to auto-merge: No This is a narrow, reversible, well-tested change, but permission enforcement warrants explicit human review before merge.

[Copilot]

Copilot review overview

🟡 Changes recommended

The route guard does not normalize trailing-slash paths, allowing unauthorized /design-system/ requests to receive the admin shell instead of a 404.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 1

Open (1)

• Normalize design-system paths to enforce the route allowlist · New

What changed in this PR

This pull request gates the admin Design System by the existing inbox allowlist and centralizes case-insensitive principal matching.

Changes:

• Shares INBOX_USERS matching across web and admin surfaces.
• Adds admin permission bootstrap and route/navigation gating.
• Expands tests for permissions, routing, and allowlist behavior.

File	Summary
plugins/​web-ui/​test/​inbox-source.test.ts	Tests shared inbox allowlist usage.
plugins/​web-ui/​server/​index.ts	Reuses the shared matcher.
plugins/​chassis/​src/​principal-allowlist.ts	Provides reusable principal matching.
plugins/​admin/​test/​whoami.test.ts	Tests permission bootstrap.
plugins/​admin/​test/​principal-allowlist.test.ts	Tests normalization and the all override.
plugins/​admin/​test/​default-view.test.ts	Tests client-side route gating.
plugins/​admin/​test/​branding.test.ts	Tests authorized and denied routes.
plugins/​admin/​src/​index.ts	Adds permissions and server route authorization.
plugins/​admin/​public/​index.html	Gates Design System navigation and client routing.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🟡 Changes recommended

Unresolved route authorization, permission preservation, and admin configuration findings block approval.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 1

Open (1)

• Authorize /design aliases before generic shell handling · New

Resolved since last review (1)

• Normalize design-system paths to enforce the route allowlist