Harden user management integration

src/app/config/layout.tsx

@@ -4,26 +4,27 @@ import Link from "next/link";
 import { usePathname, useRouter } from "next/navigation";
 import { useEffect } from "react";
 import { useAuth } from "../../frontend/components/AuthProvider";
-
-const CONFIG_TABS = [
-  { href: "/config/benutzer", label: "Benutzer" },
-  { href: "/config/konto", label: "Konto" },
-] as const;
+import {
+  getConfigRedirect,
+  getConfigTabs,
+} from "../../frontend/utils/config-access";
 
 export default function ConfigLayout({ children }: { children: React.ReactNode }) {
   const pathname = usePathname();
   const router = useRouter();
   const { status, isAdmin } = useAuth();
+  const tabs = getConfigTabs(isAdmin);
+  const redirectTarget = getConfigRedirect(pathname, isAdmin);
 
   useEffect(() => {
-    // LoginGate already guarantees a signed-in user with a set password by
-    // the time this layout renders; only the role still needs checking.
-    if (status === "signed-in" && !isAdmin) {
-      router.replace("/");
-    }
-  }, [status, isAdmin, router]);
+    if (status !== "signed-in") return;
+    if (redirectTarget) router.replace(redirectTarget);
+  }, [status, redirectTarget, router]);
 
-  if (status !== "signed-in" || !isAdmin) {
+  if (
+    status !== "signed-in" ||
+    redirectTarget !== null
+  ) {
     return null;
   }
 
@@ -34,7 +35,7 @@ export default function ConfigLayout({ children }: { children: React.ReactNode }
       </div>
 
       <nav className="config-tabs">
-        {CONFIG_TABS.map((tab) => (
+        {tabs.map((tab) => (
           <Link
             key={tab.href}
             href={tab.href}