From f040f45ad9871b33aca280c8bcc629f8d2d1af7a Mon Sep 17 00:00:00 2001
From: michelleyeoh <michellew.yeoh@gmail.com>
Date: Sun, 8 Mar 2026 21:07:54 -0700
Subject: [PATCH] restrict admin users

---
 .../ProtectedDisplay/ProtectedDisplay.tsx        |  6 ++++++
 app/(pages)/admin/layout.tsx                     | 16 +++++++++++++++-
 2 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/app/(pages)/_components/ProtectedDisplay/ProtectedDisplay.tsx b/app/(pages)/_components/ProtectedDisplay/ProtectedDisplay.tsx
index 6ea887a8..5b78bda8 100644
--- a/app/(pages)/_components/ProtectedDisplay/ProtectedDisplay.tsx
+++ b/app/(pages)/_components/ProtectedDisplay/ProtectedDisplay.tsx
@@ -4,15 +4,21 @@ import getActiveUser from 'app/(pages)/_utils/getActiveUser';
 
 export default async function ProtectedDisplay({
   allowedRoles,
+  allowedUsers,
   failRedirectRoute,
   children,
 }: {
   allowedRoles: string[];
+  allowedUsers?: string[];
   failRedirectRoute: string;
   children: React.ReactNode;
 }) {
   const user = await getActiveUser(failRedirectRoute);
 
+  if (allowedUsers && !allowedUsers.includes(user.email)) {
+    redirect('/');
+  }
+
   const authorized = allowedRoles.includes(user.role);
 
   if (user.role === 'hacker') {
diff --git a/app/(pages)/admin/layout.tsx b/app/(pages)/admin/layout.tsx
index ddc1f0f1..0aff7436 100644
--- a/app/(pages)/admin/layout.tsx
+++ b/app/(pages)/admin/layout.tsx
@@ -10,8 +10,22 @@ export default function AdminLayout({
 }: {
   children: React.ReactNode;
 }) {
+  const adminEmail = process.env.HUB_ADMIN_EMAIL;
+
+  if (!adminEmail) {
+    console.warn(
+      'HUB_ADMIN_EMAIL environment variable is not set, no users will have access to the admin panel'
+    );
+  }
+
+  const parsedAdminEmail = adminEmail ? adminEmail : '';
+
   return (
-    <ProtectedDisplay allowedRoles={['admin']} failRedirectRoute="/login">
+    <ProtectedDisplay
+      allowedRoles={['admin']}
+      allowedUsers={[parsedAdminEmail]}
+      failRedirectRoute="/login"
+    >
       {children}
     </ProtectedDisplay>
   );