The UI hides a page, and the API does not

Symptom

The admin screen is hidden unless a localStorage flag is set. The request that loads the data still succeeds without that flag.

Root cause

Lovable's security best practices say all frontend code can be inspected or bypassed, and that frontend code should never make security decisions. The page shows a localStorage authToken check that reveals an admin panel as the wrong pattern, and a server check with supabase.auth.getUser() as the right one. It also says client-side validation improves the experience and provides no security guarantee. Replit's shared responsibility model puts usage policy and access control on you, including which users can reach which parts of a published app.

In this project only, find client checks that decide access: localStorage tokens, hidden buttons, and redirects that are the only gate.

1. Keep those checks for the UI if you want, but do not treat them as security.
2. On every server route, Edge Function, and database policy that returns private data, require a verified session and an authorization rule.
3. Return 401 when getUser() has no user.
4. Move validation of emails, prices, and roles to that server code.

Do not add a client-only admin flag.

Paste this into the coding tool that has your own project open.

2-minute self-check

These steps are for an app you own. Do not run them against someone else's project.

1. Search your own client code for localStorage auth checks and for routes that render admin UI.
2. Signed out of your own app, call the data endpoint your admin screen uses, using the same URL the UI uses. It should reject you.
3. Sign in as a non-admin test user and repeat. You should not receive admin data.

Sources

• Lovable: Security best practices
• Replit: Shared responsibility model