From d313d82f4b4fbffa5f3c9e51494feae816196503 Mon Sep 17 00:00:00 2001
From: Vladimir Valekzhanin <valdemarcheck@yandex.ru>
Date: Fri, 16 Oct 2026 19:26:19 +0300
Subject: [PATCH] =?UTF-8?q?fix(=D0=BD=D0=B0=D0=B2=D0=B8=D0=B3=D0=B0=D1=86?=
 =?UTF-8?q?=D0=B8=D1=8F):=20=D0=B7=D0=B0=D0=BF=D1=80=D0=B5=D1=82=20=D0=BF?=
 =?UTF-8?q?=D0=B5=D1=80=D0=B5=D1=85=D0=BE=D0=B4=D0=B0=20=D0=BC=D0=B5=D0=B6?=
 =?UTF-8?q?=D0=B4=D1=83=20=D1=81=D0=BF=D0=B8=D1=81=D0=BA=D0=B0=D0=BC=D0=B8?=
 =?UTF-8?q?=20=D0=B4=D0=BB=D1=8F=20=D0=BD=D0=B5-=D0=B0=D0=B4=D0=BC=D0=B8?=
 =?UTF-8?q?=D0=BD=D0=BE=D0=B2?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

onOpenUsers и onOpenResources молча возвращаются без навигации,
если пользователь не админ; null-safe по образцу #74.

Closes #85
---
 .../controllers/ResourceListController.java                  | 4 ++++
 .../controllers/UsersListController.java                     | 4 ++++
 .../ui/AdminNavigationButtonsTest.java                       | 5 -----
 3 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/src/main/java/com/DesktopApplicationClientJava/controllers/ResourceListController.java b/src/main/java/com/DesktopApplicationClientJava/controllers/ResourceListController.java
index 29fec53..88dd70d 100644
--- a/src/main/java/com/DesktopApplicationClientJava/controllers/ResourceListController.java
+++ b/src/main/java/com/DesktopApplicationClientJava/controllers/ResourceListController.java
@@ -141,6 +141,10 @@ private void updateDeleteButtonState() {
 
   @FXML
   private void onOpenUsers(ActionEvent e) {
+    var authService = services == null ? null : services.getAuthService();
+    if (authService == null || !authService.isAdmin()) {
+      return;
+    }
     navigator.goTo("/fxml/UserList.fxml");
   }
 
diff --git a/src/main/java/com/DesktopApplicationClientJava/controllers/UsersListController.java b/src/main/java/com/DesktopApplicationClientJava/controllers/UsersListController.java
index 4d57c58..965d43f 100644
--- a/src/main/java/com/DesktopApplicationClientJava/controllers/UsersListController.java
+++ b/src/main/java/com/DesktopApplicationClientJava/controllers/UsersListController.java
@@ -87,6 +87,10 @@ private void setupSort() {
 
   @FXML
   private void onOpenResources(ActionEvent e) {
+    var authService = services == null ? null : services.getAuthService();
+    if (authService == null || !authService.isAdmin()) {
+      return;
+    }
     navigator.goTo("/fxml/ResourceList.fxml");
   }
 
diff --git a/src/test/java/com/DesktopApplicationClientJava/ui/AdminNavigationButtonsTest.java b/src/test/java/com/DesktopApplicationClientJava/ui/AdminNavigationButtonsTest.java
index e9e7f7c..0905b73 100644
--- a/src/test/java/com/DesktopApplicationClientJava/ui/AdminNavigationButtonsTest.java
+++ b/src/test/java/com/DesktopApplicationClientJava/ui/AdminNavigationButtonsTest.java
@@ -44,7 +44,6 @@
 import javafx.scene.control.TextField;
 import javafx.stage.Stage;
 import org.junit.jupiter.api.BeforeEach;
-import org.junit.jupiter.api.Disabled;
 import org.junit.jupiter.api.DisplayName;
 import org.junit.jupiter.api.Tag;
 import org.junit.jupiter.api.Test;
@@ -274,8 +273,6 @@ void circularNavigationGoesBothWays() {
   @Test
   @Tag("role:moder")
   @DisplayName("Модер не может перейти на список пользователей")
-  @Disabled(
-      "Gated: onOpenUsers ведёт на UserList безусловно, без проверки роли (скрытие кнопки ≠ запрет перехода)")
   void nonAdminCannotNavigateToUserList() {
     robot.interact(
         () -> {
@@ -290,8 +287,6 @@ void nonAdminCannotNavigateToUserList() {
   @Test
   @Tag("role:moder")
   @DisplayName("Модер не может перейти на список ресурсов")
-  @Disabled(
-      "Gated: onOpenResources ведёт на ResourceList безусловно, без проверки роли (скрытие кнопки ≠ запрет перехода)")
   void nonAdminCannotNavigateToResourceList() {
     robot.interact(
         () -> {