#1141 Fix: Hide node Alert button from environment admins Pull request opened by javuto Hide node Alert button from environment admins Problem On the node detail page, environment admins could see the Alert button. The alerts API (

requireAlertsAdmin

in

cmd/api/handlers/alerts.go

) only accepts global admins, so when an environment admin clicked it, the API returned a 403 and logged it as a denied access attempt. Change • The node page Alert button now shows only when

me.admin === true

, instead of using

canAdminNode

(which also lets environment admins through). This matches the alert-rule coverage query on the same page, which already required a global admin. • Added a regression test: an environment admin with alerts enabled does not see the Alert button. The server behavior is unchanged. Letting environment admins create alerts for their own environment is a separate feature, because every alerts handler would first need environment-scoped permission checks. Security / operational impact None on the server side: authorization still happens only in the API. This change just stops the UI from offering an action the API will refuse, so these predictable 403s no longer show up in the logs. Validation • `npx vitest run src/features/nodes`: 13 files, 208 tests pass • `npm run check`: passes No screenshot: the change removes a button for one role, and the global-admin view looks the same as before. jmpsec/osctrl