on_mount hook that refuses an admin page to anyone whose permissions its declaration does not allow. Attached once, in MishkaCmsCore.ExtensionLiveView, so it covers every admin LiveView without a line in any of them.

It reads socket.view — the module the router resolved — never the URL. That is the whole point: a URL is a string the client chooses and can spell more than one way (/admin/dashboard//account/permissions routes to the same page as the single-slash form), while the mounted module is a fact by the time this runs.

mount is the right callback for "may this user open this page": a direct URL goes through the plug pipeline and mounts, and a push_navigate from another page skips the pipeline but still mounts. A push_patch within the same page re-runs only handle_params, which is fine — same page, same declaration, already decided here.

Undeclared means refused. A page with no entry in MishkaCmsCore.Sidebar gets [] and is denied, so the failure mode of forgetting a declaration is a locked page, never an open one.