Permission-Aware UI Without Client-Side Trust Improve UX with capabilities while keeping authorization authoritative on the API
Phase 20 - Production Application UI Volume 06 - Professional Frontend
v
v
v
Phase 20 turns the secure full-stack foundation into a coherent, accessible application interface without moving business authority into the browser.
Permission-aware UI improves clarity but never replaces backend authorization Phase 19 owns the security decision. Phase 20 can use known permissions to hide or disable impossible actions, reducing user frustration, but callers can still construct HTTP requests manually.
v
v
v
v
v
The browser optimizes experience; the API enforces security.
Disable + explanation User benefits from knowing the action exists but why unavailable
Show then handle 403 Capability may change or resource rule is only known server-side
Never render secret data Unauthorized sensitive content should never be fetched into the browser
Avoid role-name conditionals everywhere Instead of `if role === ADMIN` in dozens of components, prefer capability-oriented data such as `canCreateTask`, `canManageMembers`, or a normalized permission set supplied by a trusted server path.
No “security by hidden button”
DevTools can alter DOM and requests. Phase 18/19 API guards remain the enforcement point for every protected mutation and resource lookup.
Authorization decides what an authenticated identity may do to a specific resource. UI hiding is never a substitute for server-side enforcement.
Restate the goal of “Permission Aware UI without Client Side Trust” as one observable behavior. Write the success signal before touching code.
Trace the boundary map: trusted identity → requested action → resource scope → policy decision → allow/deny. Mark the one boundary this lesson changes.
Inspect the current repository state and record the exact files, route, table, or runtime involved. Avoid creating an abstraction before you can name the existing owner.
Implement the smallest vertical slice. Add one coherent change, run the narrowest verification command, and read the output before continuing.
Connect the slice to TaskFlow’s phase artifact: TaskFlow responsive shell with navigation, workspace context, task screens, loading/empty/error states, and accessible interactions.. Verify behavior from the outside as a user or API client would.
Create one controlled failure that is safe to reproduce. Predict the symptom first, capture evidence, locate the earliest broken boundary, then fix only that cause.
Close the reference and rebuild or explain the core change from memory. Record what you would monitor or test before trusting the same change in production.
const canEdit =
user.role === "ADMIN" ||
(user.role === "MEMBER" && task.ownerId === user.id);
if (!canEdit) throw new ForbiddenException();Do not copy this as a finished answer. Predict what each boundary does, type the smallest useful slice, run it, then compare the result with your prediction.
Trace verified identity, role, resource owner/workspace, and policy inputs separately.
Add server-side resource authorization; UI visibility is only experience, never enforcement.
Without copying the final source, create a second small scenario that applies “Permission Aware UI without Client Side Trust” to a different TaskFlow resource or input. Write the acceptance criteria first, implement it, and provide the evidence that each criterion is satisfied.
Compose Server and Client Components so interactive islands remain small.
Use the smallest change that demonstrates this lesson. Stop after it works and capture evidence.Global client component wrapping the whole app
Predict the symptom before causing the failure. Then locate the earliest boundary where reality diverges from expectation.Why does this responsibility live here, what input does it trust, what output proves success, and what would go wrong if another layer owned it?
If your explanation is vague, repeat the boundary trace before moving on.Close the reference. Reproduce the core idea from memory or explain the exact request/data flow aloud. Then check your diff or notes for accidental shortcuts that bypass validation, authorization, error handling, or verification earned in earlier phases.