do not show Config tab for non-admins

client/coral-admin/src/components/ui/Header.js

@@ -5,8 +5,14 @@ import styles from './Header.css';
 import I18n from 'coral-framework/modules/i18n/i18n';
 import translations from '../../translations.json';
 import {Logo} from './Logo';
+import {can} from 'coral-framework/utils/roles';
 
-const CoralHeader = ({handleLogout, showShortcuts = () => {}, restricted = false}) => (
+const CoralHeader = ({
+  handleLogout,
+  showShortcuts = () => {},
+  restricted = false,
+  auth
+}) => (
   <Header className={styles.header}>
     <Logo className={styles.logo} />
     {
@@ -41,13 +47,17 @@ const CoralHeader = ({handleLogout, showShortcuts = () => {}, restricted = false
             activeClassName={styles.active}>
             {lang.t('configure.community')}
           </Link>
-          <Link
-            id='configureNav'
-            className={styles.navLink}
-            to="/admin/configure"
-            activeClassName={styles.active}>
-            {lang.t('configure.configure')}
-          </Link>
+          {
+            auth.user && can(auth.user, 'UPDATE_CONFIG') && (
+              <Link
+                id='configureNav'
+                className={styles.navLink}
+                to="/admin/configure"
+                activeClassName={styles.active}>
+                {lang.t('configure.configure')}
+              </Link>
+            )
+          }
         </Navigation>
         <div className={styles.rightPanel}>
           <ul>
@@ -73,6 +83,7 @@ const CoralHeader = ({handleLogout, showShortcuts = () => {}, restricted = false
 );
 
 CoralHeader.propTypes = {
+  auth: PropTypes.object.isRequired,
   showShortcuts: PropTypes.func,
   handleLogout: PropTypes.func.isRequired,
   restricted: PropTypes.bool // hide elemnts from a user that's logged out

client/coral-admin/src/components/ui/Layout.js

@@ -4,7 +4,12 @@ import Header from './Header';
 import Drawer from './Drawer';
 import styles from './Layout.css';
 
-const Layout = ({children, handleLogout = () => {}, toggleShortcutModal, restricted = false, ...props}) => (
+const Layout = ({
+  children,
+  handleLogout = () => {},
+  toggleShortcutModal,
+  restricted = false,
+  ...props}) => (
   <LayoutMDL fixedDrawer>
     <Header
       handleLogout={handleLogout}

client/coral-admin/src/containers/Configure/Configure.js

@@ -15,6 +15,7 @@ import translations from 'coral-admin/src/translations.json';
 import StreamSettings from './StreamSettings';
 import ModerationSettings from './ModerationSettings';
 import TechSettings from './TechSettings';
+import {can} from 'coral-framework/utils/roles';
 
 class Configure extends Component {
   constructor (props) {
@@ -118,6 +119,11 @@ class Configure extends Component {
   render () {
     const {activeSection} = this.state;
     const section = this.getSection(activeSection);
+    const {auth: user} = this.props;
+
+    if (!can(user, 'UPDATE_CONFIG')) {
+      return <p>You must be an administrator to access config settings. Please find the nearest Admin and ask them to level you up!</p>;
+    }
 
     const showSave = Object.keys(this.state.errors).reduce(
       (bool, error) => this.state.errors[error] ? false : bool, this.state.changed);
@@ -172,6 +178,7 @@ class Configure extends Component {
 }
 
 const mapStateToProps = (state) => ({
+  auth: state.auth.toJS(),
   settings: state.settings.toJS()
 });
 export default connect(mapStateToProps)(Configure);

client/coral-framework/utils/roles.js

@@ -5,7 +5,7 @@ const basicRoles = {
 };
 
 const queryRoles = {
-  UPDATE_CONFIG: ['ADMIN', 'MODERATOR'],
+  UPDATE_CONFIG: ['ADMIN'],
   ACCESS_ADMIN: ['ADMIN', 'MODERATOR'],
   VIEW_USER_EMAILS: ['ADMIN']
 };