From 533783ba3ecc613cf05e08366a4d019d3d717d1f Mon Sep 17 00:00:00 2001
From: Alex Holliday <ajhollid@gmail.com>
Date: Tue, 8 Sep 2026 15:51:17 -0700
Subject: [PATCH 1/3] gate client side log page behind admin check

---
 client/src/Pages/Docker/ContainerDetails/TabLogs.tsx | 11 +++++++++++
 client/src/locales/en.json                           |  4 ++++
 2 files changed, 15 insertions(+)

diff --git a/client/src/Pages/Docker/ContainerDetails/TabLogs.tsx b/client/src/Pages/Docker/ContainerDetails/TabLogs.tsx
index e7e29207d..4a7495f9a 100644
--- a/client/src/Pages/Docker/ContainerDetails/TabLogs.tsx
+++ b/client/src/Pages/Docker/ContainerDetails/TabLogs.tsx
@@ -23,6 +23,7 @@ import {
 import { useTheme } from "@mui/material";
 import { useTranslation } from "react-i18next";
 import { useToast } from "@/Hooks/UseToast";
+import { useIsAdmin } from "@/Hooks/useIsAdmin";
 
 // Utils
 import { get } from "@/Utils/ApiClient";
@@ -50,6 +51,7 @@ export const TabLogs = ({ monitorId, containerName, enabled }: TabLogsProps) =>
 	const theme = useTheme();
 	const { t } = useTranslation();
 	const { toastError } = useToast();
+	const isAdmin = useIsAdmin();
 
 	// logs is newest-first, matching the API and what flattenDockerLogs expects.
 	const [logs, setLogs] = useState<DockerLog[]>([]);
@@ -168,6 +170,15 @@ export const TabLogs = ({ monitorId, containerName, enabled }: TabLogsProps) =>
 		}
 	}, [logsUrl, oldestCursor, loadingOlder, t, toastError]);
 
+	if (!isAdmin) {
+		return (
+			<EmptyState
+				title={t("pages.docker.container.logs.forbidden.title")}
+				description={t("pages.docker.container.logs.forbidden.description")}
+			/>
+		);
+	}
+
 	if (!enabled) {
 		return (
 			<EmptyState
diff --git a/client/src/locales/en.json b/client/src/locales/en.json
index 665893f21..600faa714 100644
--- a/client/src/locales/en.json
+++ b/client/src/locales/en.json
@@ -985,6 +985,10 @@
 						"title": "Log collection is off for this host",
 						"description": "Turn on container logs in the monitor settings to start collecting.",
 						"action": "Configure monitor"
+					},
+					"forbidden": {
+						"title": "You don't have access to container logs",
+						"description": "Only administrators can view logs. Ask an administrator for access if you need to see them."
 					}
 				}
 			},

From a8dc867e7821057c93c6f8123d8bc17bb128ac2f Mon Sep 17 00:00:00 2001
From: Alex Holliday <ajhollid@gmail.com>
Date: Tue, 8 Sep 2026 15:52:43 -0700
Subject: [PATCH 2/3] add admin gate to API route

---
 server/src/api/routes/monitorRoutes.ts | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/server/src/api/routes/monitorRoutes.ts b/server/src/api/routes/monitorRoutes.ts
index dab4614cd..7e3a4230f 100644
--- a/server/src/api/routes/monitorRoutes.ts
+++ b/server/src/api/routes/monitorRoutes.ts
@@ -21,7 +21,11 @@ export const createMonitorRoutes = (monitorController: IMonitorController): Rout
 	// Docker routes
 	router.get("/docker/details/:monitorId", monitorController.getDockerDetailsById);
 	router.get("/docker/details/:monitorId/containers/:containerName", monitorController.getDockerContainerByName);
-	router.get("/docker/details/:monitorId/containers/:containerName/logs", monitorController.getDockerContainerLogs);
+	router.get(
+		"/docker/details/:monitorId/containers/:containerName/logs",
+		isAllowed(["admin", "superadmin"]),
+		monitorController.getDockerContainerLogs
+	);
 
 	// Geo checks routes
 	router.get("/:monitorId/geo-checks", monitorController.getGeoChecksByMonitorId);

From 04277a6eb4bfbd1b5a36c85643dfbc26c7707746 Mon Sep 17 00:00:00 2001
From: Alex Holliday <ajhollid@gmail.com>
Date: Tue, 8 Sep 2026 15:55:17 -0700
Subject: [PATCH 3/3] add admin check to fetch request

---
 client/src/Pages/Docker/ContainerDetails/TabLogs.tsx | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/client/src/Pages/Docker/ContainerDetails/TabLogs.tsx b/client/src/Pages/Docker/ContainerDetails/TabLogs.tsx
index 4a7495f9a..792234c52 100644
--- a/client/src/Pages/Docker/ContainerDetails/TabLogs.tsx
+++ b/client/src/Pages/Docker/ContainerDetails/TabLogs.tsx
@@ -61,7 +61,7 @@ export const TabLogs = ({ monitorId, containerName, enabled }: TabLogsProps) =>
 	const [lastUpdatedAt, setLastUpdatedAt] = useState<number | null>(null);
 
 	const logsUrl =
-		enabled && monitorId && containerName
+		isAdmin && enabled && monitorId && containerName
 			? `/monitors/docker/details/${encodeURIComponent(monitorId)}/containers/${encodeURIComponent(containerName)}/logs`
 			: null;