Restricted actions remain visible for roles with limited permissions

[hureramujeeb60]

What happened?

When a team member is assigned a role with limited permissions, the UI still displays actions that the user is not authorized to perform. If the user clicks one of these restricted actions, the backend correctly blocks the request with a 403 Forbidden response.

The permission enforcement appears to work at the backend level, but the frontend does not consistently hide or disable actions based on the user’s role and effective permissions.

Steps to reproduce

1. Invite a team member with a role that has limited permissions, such as Client, Viewer, Contributor, or another restricted workspace role.
2. Sign in as that user.
3. Navigate through workspace areas such as publishing, approvals, settings, channels, media, inbox, or analytics.
4. Observe that some restricted actions are still visible.
5. Click a restricted action.
6. The system returns 403 Forbidden.

Expected behavior

Users should only see actions they are authorized to perform based on their organization role, workspace role, and effective permissions.

Restricted actions should either be:

• Hidden from the UI, or
• Disabled with a clear explanation if visibility is intentional

Setup

Docker

Operating system

Windows 11

Browser

Chrome

Relevant log output

Additional context

No response

[JanSchm]

@hureramujeeb60 could you roughly specify which UI elements you mean?

[hureramujeeb60]

@JanSchm I am currently logged into this workspace with a Client role. As a client, I should not have access to the Social Inbox, but the menu item is still visible and clickable. When I click it, I am redirected to a 403 Forbidden page. This should be handled more gracefully—either by hiding the Social Inbox option for users without permission or by providing a clearer access-restricted message. I have attached the video for your reference

Recording.2026-06-25.204751.mp4

[JanSchm]

@hureramujeeb60 thank you for putting in the effort and providing the recoding, highly appreciated.
I agree with you, restricted areas of the app should not be visible to a user. I'll put together a fix in the next couple of days.

[alarictabaries]

Hello, is a fix still planned?
Thanks!