From 5466c6ddf66240e2b1f1e4b8bca93f1060b9ae3d Mon Sep 17 00:00:00 2001
From: juhanikat <juhani.kataja@gmail.com>
Date: Mon, 28 Sep 2026 13:49:17 +0300
Subject: [PATCH] make projects list available to admins only, and update docs

---
 backend/src/routes/project.ts      | 2 +-
 documentation/user_rights.md       | 2 +-
 frontend/src/components/NavBar.tsx | 2 +-
 frontend/src/pages/ProjectPage.tsx | 1 +
 4 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/backend/src/routes/project.ts b/backend/src/routes/project.ts
index 17c00213..aeac01f9 100644
--- a/backend/src/routes/project.ts
+++ b/backend/src/routes/project.ts
@@ -6,7 +6,7 @@ import { writeProject } from '../services/write/project'
 
 const router = Router()
 
-router.get('/all', async (req, res) => {
+router.get('/all', requireOneOf([Role.Admin]), async (req, res) => {
   const projects = await getAllProjects(req.user)
   return res.status(200).send(projects)
 })
diff --git a/documentation/user_rights.md b/documentation/user_rights.md
index 41bd11d1..a119384f 100644
--- a/documentation/user_rights.md
+++ b/documentation/user_rights.md
@@ -91,7 +91,7 @@ NOTE: Users with the **EditRestricted** role can only update occurrences that re
 
 ## Project
 
-- Any user can get a list of Projects.
+- Viewing a list of projects requires the **Admin** role.
 - Viewing project details requires the **Admin** role.
 - Creating or updating a Project requires the **Admin** role.
 - Deleting a Project requires the **Admin** role.
diff --git a/frontend/src/components/NavBar.tsx b/frontend/src/components/NavBar.tsx
index 7ed2ceab..34c3590d 100755
--- a/frontend/src/components/NavBar.tsx
+++ b/frontend/src/components/NavBar.tsx
@@ -26,7 +26,7 @@ export const NavBar = () => {
     { title: 'Time Units', url: '/time-unit' },
     { title: 'Time Bounds', url: '/time-bound', allowedRoles: [Role.Admin, Role.EditUnrestricted] },
     { title: 'Museums', url: '/museum' },
-    { title: 'Projects', url: '/project' },
+    { title: 'Projects', url: '/project', allowedRoles: [Role.Admin] },
     {
       title: 'Admin',
       url: '/admin',
diff --git a/frontend/src/pages/ProjectPage.tsx b/frontend/src/pages/ProjectPage.tsx
index 11647a1f..bf78a6af 100644
--- a/frontend/src/pages/ProjectPage.tsx
+++ b/frontend/src/pages/ProjectPage.tsx
@@ -9,6 +9,7 @@ import { Page } from '../components/Page'
 export const ProjectPage = () => {
   return (
     <Page
+      allowedRoles={[Role.Admin]}
       tableView={<ProjectTable />}
       detailView={<ProjectDetails />}
       viewName="project"