diff --git a/src/Web/autopilot-monitor-web/app/dashboard/page.tsx b/src/Web/autopilot-monitor-web/app/dashboard/page.tsx index 9d5ff283..d6ebe801 100644 --- a/src/Web/autopilot-monitor-web/app/dashboard/page.tsx +++ b/src/Web/autopilot-monitor-web/app/dashboard/page.tsx @@ -144,11 +144,12 @@ function HomeContent() { disabled: isRegularUser, }); - // Redirect regular users (non-admin, non-operator, no platform scope) to the progress portal — they - // must never see the session list. A read-only Global Reader has cross-tenant read scope → stays. + // Redirect users without own-tenant/platform scope away from the session list. A delegated ("MSP") admin + // manages OTHER tenants and belongs on the fleet overview, not the end-user progress portal; everyone else + // without scope goes to /progress. A read-only Global Reader has cross-tenant read scope → stays. useEffect(() => { if (user && !user.isTenantAdmin && !user.isGlobalAdmin && !user.isGlobalReader && user.role !== 'Operator') { - router.replace("/progress"); + router.replace(user.isDelegated ? "/fleet" : "/progress"); } }, [user, router]); diff --git a/src/Web/autopilot-monitor-web/components/GlobalSidebar.tsx b/src/Web/autopilot-monitor-web/components/GlobalSidebar.tsx index 9d797215..79bb8f2c 100644 --- a/src/Web/autopilot-monitor-web/components/GlobalSidebar.tsx +++ b/src/Web/autopilot-monitor-web/components/GlobalSidebar.tsx @@ -399,14 +399,18 @@ export function GlobalSidebar({ children }: { children: ReactNode }) { // Regular users see minimal nav. A read-only Global Reader has platform scope, and a delegated MSP admin // has fleet scope → both get the (group-filtered) nav rather than the minimal regular-user list. const isRegularUser = !isAdminOrOperator && !hasFleetScope; + // The Dashboard (own-tenant session list) is only meaningful for a genuine own-tenant/platform user. + // A delegated-only MSP admin has no own-tenant stake — /dashboard would just bounce them to /fleet — + // so hide the link for them; their entry point is the Fleet group. + const showDashboard = isAdminOrOperator || hasGlobalScope; const renderNavContent = (isMobile = false) => ( <> {/* Global nav — only when authenticated */} {isAuthenticated && ( <> - {/* Dashboard — hidden for regular users (no admin/operator access) */} - {!isRegularUser && ( + {/* Dashboard — own-tenant session list; hidden for regular users AND delegated-only MSP admins */} + {showDashboard && (