@@ -25,6 +25,7 @@ import 'package:flutter_news_app_web_dashboard_full_source_code/content_manageme
2525import 'package:flutter_news_app_web_dashboard_full_source_code/content_management/view/edit_topic_page.dart' ;
2626import 'package:flutter_news_app_web_dashboard_full_source_code/content_management/widgets/filter_dialog/bloc/filter_dialog_bloc.dart' ;
2727import 'package:flutter_news_app_web_dashboard_full_source_code/content_management/widgets/filter_dialog/filter_dialog.dart' ;
28+ import 'package:flutter_news_app_web_dashboard_full_source_code/l10n/l10n.dart' ;
2829import 'package:flutter_news_app_web_dashboard_full_source_code/local_ads_management/bloc/filter_local_ads/filter_local_ads_bloc.dart' ;
2930import 'package:flutter_news_app_web_dashboard_full_source_code/local_ads_management/view/create_local_banner_ad_page.dart' ;
3031import 'package:flutter_news_app_web_dashboard_full_source_code/local_ads_management/view/create_local_interstitial_ad_page.dart' ;
@@ -38,6 +39,7 @@ import 'package:flutter_news_app_web_dashboard_full_source_code/local_ads_manage
3839import 'package:flutter_news_app_web_dashboard_full_source_code/local_ads_management/widgets/local_ads_filter_dialog/bloc/local_ads_filter_dialog_bloc.dart' ;
3940import 'package:flutter_news_app_web_dashboard_full_source_code/local_ads_management/widgets/local_ads_filter_dialog/local_ads_filter_dialog.dart' ;
4041import 'package:flutter_news_app_web_dashboard_full_source_code/overview/view/overview_page.dart' ;
42+ import 'package:flutter_news_app_web_dashboard_full_source_code/router/route_permissions.dart' ;
4143import 'package:flutter_news_app_web_dashboard_full_source_code/router/routes.dart' ;
4244import 'package:flutter_news_app_web_dashboard_full_source_code/settings/view/settings_page.dart' ;
4345import 'package:flutter_news_app_web_dashboard_full_source_code/shared/widgets/selection_page/searchable_selection_page.dart' ;
@@ -64,6 +66,7 @@ GoRouter createRouter({
6466 // --- Redirect Logic ---
6567 redirect: (BuildContext context, GoRouterState state) {
6668 final appStatus = context.read <AppBloc >().state.status;
69+ final l10n = AppLocalizationsX (context).l10n;
6770 final currentLocation = state.matchedLocation;
6871
6972 print (
@@ -95,6 +98,32 @@ GoRouter createRouter({
9598 if (appStatus == AppStatus .authenticated) {
9699 print (' Redirect Decision: User is $appStatus .' );
97100
101+ // --- Role-Based Access Control (RBAC) ---
102+ final userRole = context.read <AppBloc >().state.user? .dashboardRole;
103+ final destinationRouteName = state.topRoute? .name;
104+
105+ // Allow navigation if role is not yet determined or route is unknown.
106+ if (userRole == null || destinationRouteName == null ) {
107+ return null ;
108+ }
109+
110+ final allowedRoutes = routePermissions[userRole];
111+
112+ // Check if the user is trying to access a route they are not
113+ // permitted to view.
114+ final isAuthorized = allowedRoutes? .contains (destinationRouteName) ??
115+ false ;
116+
117+ // Universally allowed routes like 'settings' are exempt from this check.
118+ if (! isAuthorized && destinationRouteName != Routes .settingsName) {
119+ ScaffoldMessenger .of (context).showSnackBar (
120+ SnackBar (content: Text (l10n.unauthorizedAccessRedirect)),
121+ );
122+ // Redirect unauthorized users to the overview page.
123+ return Routes .overview;
124+ }
125+ // --- End of RBAC ---
126+
98127 // If an authenticated user is on any authentication-related path:
99128 if (isGoingToAuth) {
100129 print (
0 commit comments