From c8ea18f594a64ce33217649e9c53e380a3801ac7 Mon Sep 17 00:00:00 2001
From: nntrivi2001 <vinnt@smartgift.vn>
Date: Mon, 12 Oct 2026 14:19:42 +0700
Subject: [PATCH] fix(client): a developer's Sessions page no longer asks for
 remote sources (403)

/api/remote-sources is STAFF_ONLY; Sessions loaded its labels for every
viewer, so each developer page load logged a 403.
---
 client/src/pages/Sessions.tsx | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/client/src/pages/Sessions.tsx b/client/src/pages/Sessions.tsx
index b6c37dd3..24cb886d 100644
--- a/client/src/pages/Sessions.tsx
+++ b/client/src/pages/Sessions.tsx
@@ -88,6 +88,7 @@ import { SessionRowMenu, workspaceHref } from "../components/SessionRowMenu";
 import { formatDateTime, formatDuration, truncate, fmtCost, isoOrUndefined } from "../lib/format";
 import { effectiveSessionStatus, sessionAwaitingReason } from "../lib/types";
 import type { Session, DashboardEvent } from "../lib/types";
+import { usePermissions } from "../components/AuthGate";
 
 const PAGE_SIZE = 10;
 
@@ -183,14 +184,17 @@ export function Sessions({ embedded = false }: { embedded?: boolean } = {}) {
 
   // Load remote-source labels so remote-origin rows can show a friendly badge
   // instead of a raw `src_…` id. Refreshed when a source's status changes.
+  // Staff only: a developer's /api/remote-sources is a 403 (STAFF_ONLY_PREFIXES).
+  const { seesAll } = usePermissions();
   const loadSourceLabels = useCallback(() => {
+    if (!seesAll) return;
     api.remoteSources
       .list()
       .then((res: { sources: RemoteSource[] }) => {
         setSourceLabels(new Map(res.sources.map((s) => [s.id, s.label])));
       })
       .catch(() => undefined);
-  }, []);
+  }, [seesAll]);
 
   useEffect(() => {
     loadSourceLabels();