isAdmin trick

apps/api/config/initializers/admin_cookie.rb

@@ -0,0 +1,20 @@
+# Set a JS-readable cookie when an admin signs in/out.
+# Devise's remember_admin_user_token cookie is HttpOnly,
+# so the frontend cannot read it. This non-HttpOnly cookie
+# lets the frontend show/hide the Admin menu link.
+
+Rails.application.config.to_prepare do
+  ApplicationController.class_eval do
+    after_action :sync_admin_cookie
+
+    private
+
+    def sync_admin_cookie
+      if current_admin_user
+        cookies[:is_admin] = { value: "1", httponly: false, same_site: :lax, path: "/" }
+      elsif cookies[:is_admin]
+        cookies.delete(:is_admin, path: "/")
+      end
+    end
+  end
+end