Admin nav shows only the items a user is authorized to access. Same thing the dashboard. Users with admin.maintenance can update

themes/grav/templates/dashboard.html.twig

@@ -2,6 +2,7 @@
 
 {% block titlebar %}
     <div class="button-bar">
+        {% if authorize(['admin.maintenance', 'admin.super']) %}
             <div class="button-group">
                 <button data-clear-cache="{{ base_url_relative }}/cache.json/task{{ config.system.param_sep }}clearCache" class="button"><i class="fa fa-trash"></i> {{ "PLUGIN_ADMIN.CLEAR_CACHE"|tu }}</button>
                 <button type="button" class="button dropdown-toggle" data-toggle="dropdown">
@@ -14,7 +15,9 @@
                     <li><a data-clear-cache="{{ base_url_relative }}/cache.json/task{{ config.system.param_sep }}clearCache/cleartype{{ config.system.param_sep }}cache-only" href="#">{{ "PLUGIN_ADMIN.CLEAR_CACHE_CACHE_ONLY"|tu }}</a></li>
                 </ul>
             </div>
+
             <button data-gpm-checkupdates="" class="button"><i class="fa fa-refresh"></i> {{ "PLUGIN_ADMIN.CHECK_FOR_UPDATES"|tu }}</button>
+        {% endif %}
     </div>
     <h1><i class="fa fa-fw fa-th"></i> {{ "PLUGIN_ADMIN.DASHBOARD"|tu }}</h1>
 {% endblock %}
@@ -28,6 +31,7 @@
     {% set backup = admin.lastBackup() %}
 
     <div id="admin-dashboard">
+        {% if authorize(['admin.maintenance', 'admin.super']) %}
             <div id="updates" class="dashboard-item dashboard-left">
                 <div class="tertiary-accent default-box-shadow">
                     <h1>{{ "PLUGIN_ADMIN.MAINTENANCE"|tu }}</h1>
@@ -68,6 +72,8 @@
                     </div>
                 </div>
             </div>
+        {% endif %}
+        {% if authorize(['admin.statistics', 'admin.super']) %}
             <div id="popularity" class="dashboard-item dashboard-right">
                 <div class="secondary-accent default-box-shadow">
                     <h1>{{ "PLUGIN_ADMIN.STATISTICS"|tu }}</h1>
@@ -119,6 +125,7 @@
                     </div>
                 </div>
             </div>
+        {% endif %}
     </div>
 {% endblock %}
 
@@ -128,6 +135,7 @@
     {% if config.plugins.admin.show_beta_msg %}
         <div class="error alert"><i class="fa fa-exclamation-circle"></i> {{ 'PLUGIN_ADMIN.ADMIN_BETA_MSG'|tu }}</div>
     {% endif %}
+    {% if authorize(['admin.pages', 'admin.super']) %}
         <div id="latest">
             <div class="button-bar">
                 <a class="button" href="{{ uri.route(true) }}/pages"><i class="fa fa-fw fa-file-text-o"></i>{{ "PLUGIN_ADMIN.MANAGE_PAGES"|tu }}</a>
@@ -139,6 +147,5 @@
             {% endfor %}
             </table>
         </div>
-
+    {% endif %}
 {% endblock %}
-

themes/grav/templates/partials/nav.html.twig

@@ -20,9 +20,12 @@
         <li class="{{ (location == 'dashboard') ? 'selected' : '' }}">
             <a href="{{ base_url_relative }}"><i class="fa fa-fw fa-th"></i> {{ "PLUGIN_ADMIN.DASHBOARD"|tu }}</a>
         </li>
+        {% if authorize(['admin.configuration', 'admin.super']) %}
             <li class="{{ (location == 'system' or location == 'site') ? 'selected' : '' }}">
                 <a href="{{ base_url_relative }}/system"><i class="fa fa-fw fa-wrench"></i> {{ "PLUGIN_ADMIN.CONFIGURATION"|tu }}</a>
             </li>
+        {% endif %}
+        {% if authorize(['admin.pages', 'admin.super']) %}
             <li class="{{ (location == 'pages') ? 'selected' : '' }}">
                 <a href="{{ base_url_relative }}/pages">
                     <i class="fa fa-fw fa-file-text-o"></i> {{ "PLUGIN_ADMIN.PAGES"|tu }}
@@ -31,15 +34,19 @@
                     </span>
                 </a>
             </li>
+        {% endif %}
         {% if grav.twig.plugins_hooked_nav %}
             {% for label, item in grav.twig.plugins_hooked_nav %}
+                {% if authorize(['admin.' ~ item.route, 'admin.super']) %}
                     <li class="{{ (location == item.route) ? 'selected' : '' }}">
                         <a href="{{ base_url_relative }}/{{ item.route }}">
                             <i class="fa fa-fw {{ item.icon }}"></i> {{ label|tu }}
                         </a>
                     </li>
+                {% endif %}
             {% endfor %}
         {% endif %}
+        {% if authorize(['admin.plugins', 'admin.super']) %}
             <li class="{{ (location == 'plugins') ? 'selected' : '' }}">
                 <a href="{{ base_url_relative }}/plugins">
                     <i class="fa fa-fw fa-plug"></i> {{ "PLUGIN_ADMIN.PLUGINS"|tu }}
@@ -50,6 +57,8 @@
                     </span>
                 </a>
             </li>
+        {% endif %}
+        {% if authorize(['admin.themes', 'admin.super']) %}
             <li class="{{ (location == 'themes') ? 'selected' : '' }}">
                 <a href="{{ base_url_relative }}/themes">
                     <i class="fa fa-fw fa-tint"></i> {{ "PLUGIN_ADMIN.THEMES"|tu }}
@@ -59,6 +68,7 @@
                     </span>
                 </a>
             </li>
+        {% endif %}
 
         {% include 'nav-pro.html.twig' ignore missing %}
 

themes/grav/templates/plugins.html.twig

@@ -23,8 +23,10 @@
         {% else %}
             <a class="button" href="{{ base_url }}"><i class="fa fa-reply"></i> {{ "PLUGIN_ADMIN.BACK"|tu }}</a>
             <a class="button" href="{{ base_url_relative }}/plugins/install"><i class="fa fa-plus"></i> {{ "PLUGIN_ADMIN.ADD"|tu }}</a>
+            {% if authorize(['admin.maintenance', 'admin.super']) %}
                 <button data-gpm-checkupdates="" class="button"><i class="fa fa-refresh"></i> {{ "PLUGIN_ADMIN.CHECK_FOR_UPDATES"|tu }}</button>
             {% endif %}
+        {% endif %}
         </div>
         <h1><i class="fa fa-fw fa-plug"></i> {{ "PLUGIN_ADMIN.PLUGINS"|tu }}</h1>
     {% else %}
@@ -57,4 +59,3 @@
         {% endif %}
     </div>
 {% endblock %}
-

themes/grav/templates/themes.html.twig

@@ -24,8 +24,10 @@
         {% else %}
             <a class="button" href="{{ base_url }}/"><i class="fa fa-reply"></i> {{ "PLUGIN_ADMIN.BACK"|tu }}</a>
             <a class="button" href="{{ base_url_relative }}/themes/install"><i class="fa fa-plus"></i> {{ "PLUGIN_ADMIN.ADD"|tu }}</a>
+            {% if authorize(['admin.maintenance', 'admin.super']) %}
                 <button data-gpm-checkupdates="" class="button"><i class="fa fa-refresh"></i> {{ "PLUGIN_ADMIN.CHECK_FOR_UPDATES"|tu }}</button>
             {% endif %}
+        {% endif %}
         </div>
         <h1><i class="fa fa-fw fa-plug"></i> {{ "PLUGIN_ADMIN.THEMES"|tu }}</h1>
     {% else %}
@@ -56,6 +58,3 @@
         {% endif %}
     </div>
 {% endblock %}
-
-
-