See Only Role-Appropriate Navigation Destinations
The App Router Service applies role-based route guards at the shell level using Riverpod providers that reactively read the authenticated user's role from Supabase. The Navigation State Store holds the current role and exposes it to the Bottom Navigation Bar and Navigation Shell Widget. Routes inaccessible to the current role redirect to the No-Access screen or are simply not rendered. Coordinators see coordinator-specific content in the Work and Home tabs; organization administrators see administrative controls; peer mentors see personal activity and statistics content.
User Story
Acceptance Criteria
- Given a peer mentor is authenticated, when the shell renders, then the Work tab content shows personal assignment inbox and activity summaries, not coordinator approval queues
- Given a coordinator is authenticated, when the shell renders, then the Work tab content includes member overview, activity approval queue, and proxy registration options
- Given an organization administrator is authenticated, when the shell renders, then the Home and Work tabs surface administrative dashboards and org configuration links
- Given any role, when the user attempts to navigate directly to a route they do not have permission for (e.g., via a deep link), then they are redirected to the No-Access screen with a clear message
- Given the user's role changes in the backend (e.g., downgraded by an admin), when the Supabase auth state updates reactively, then the navigation shell re-evaluates route guards and removes access immediately without requiring a manual logout
Business Value
Role-based navigation filtering is essential for security and usability. Coordinators and administrators must not expose sensitive approval workflows, bulk registration screens, or org configuration to peer mentors. Equally, presenting role-irrelevant options to peer mentors increases cognitive load, a key risk factor for the beginner-level users who make up the majority of the user base. Reactive role enforcement also prevents stale-permission vulnerabilities when roles change.
Components
- App Router Service service
- Navigation State Store data
- Navigation Shell Widget ui
- Bottom Navigation Bar ui